Description Summary:
SiYuan versions 3.8.1 and earlier contain an incomplete blocklist in the IsForbiddenAbsPath function, allowing authenticated users to retrieve sensitive TLS and CA private keys.

Executive Summary:
A critical vulnerability in SiYuan versions 3.8.1 and earlier allows authenticated users to access sensitive private keys, potentially leading to full traffic decryption and certificate forgery.

Vulnerability Details

CVE-ID: CVE-2026-85175

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.8.2

Vulnerability: The application utilizes an insufficient blocklist within the IsForbiddenAbsPath function, which fails to restrict access to sensitive files like TLS private keys (conf/key.pem) and CA keys (conf/ca.key). Because the getFile handler incorrectly assigns administrative privileges to all authenticated users, any user can retrieve these sensitive keys via the POST /api/file/getFile endpoint.

Business Impact

The compromise of TLS and CA private keys represents a severe security failure that undermines the confidentiality and integrity of all encrypted communication. An attacker possessing these keys can decrypt intercepted HTTPS traffic and issue fraudulent certificates that appear trusted by clients, resulting in significant data exposure, credential theft, and total loss of communication privacy. With a CVSS score of 8.8, this high severity vulnerability necessitates immediate attention to prevent lateral movement and broader system compromise.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.8.2 or later to apply the necessary security patches and blocklist updates.

Proactive Monitoring: Review access logs for the /api/file/getFile endpoint, specifically monitoring for unauthorized or suspicious requests originating from standard user accounts.

Compensating Controls: Restrict network access to the SiYuan administrative interface and sensitive API endpoints using a Web Application Firewall or network segmentation to prevent exploitation by unauthorized actors.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the ease with which administrative access is granted to all authenticated users, enabling the retrieval of highly sensitive cryptographic material.

Analyst Recommendation

Given the potential for total compromise of encrypted sessions and certificate authority integrity, organizations must prioritize upgrading to version 3.8.2 immediately. Ensure that the patch is applied across all instances of the application, particularly those with TLS enabled, to mitigate the risk of traffic interception and certificate forgery.

Description Summary:
SiYuan versions prior to 3.8.2 insecurely log API tokens in plaintext, allowing authenticated attackers to gain administrative access via the getFile endpoint.

Executive Summary:
A critical vulnerability in SiYuan prior to version 3.8.2 allows authenticated attackers to harvest administrative API tokens through insecure log files, leading to full unauthorized administrative control.

Vulnerability Details

CVE-ID: CVE-2026-85174

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.8.2

Vulnerability: This flaw involves the insertion of sensitive information into log files (CWE-532), where API tokens are recorded in plaintext during specific full-text search operations. Any authenticated attacker can subsequently exploit this by accessing the logs via the getFile endpoint to escalate privileges to the administrative level.

Business Impact

The potential for full administrative account takeover represents a significant security risk, potentially leading to total system compromise, unauthorized data access, and loss of control over the application environment. Given the high CVSS score of 8.8, this vulnerability poses a severe threat to the confidentiality and integrity of the SiYuan instance, necessitating immediate remediation to prevent persistent unauthorized access.

Remediation Plan

Immediate Action: Upgrade the SiYuan installation to version 3.8.2 or later, which addresses the insecure logging behavior.

Proactive Monitoring: Review application access logs for unusual activity or repeated requests to the getFile endpoint that may indicate attempts to retrieve sensitive configuration files.

Compensating Controls: Restrict access to the application instance at the network level and implement strict role-based access control to ensure that only authorized personnel have access to the underlying server environment.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of September 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is straightforward to execute once an attacker has authenticated access, making prompt patching essential to prevent potential exploitation.

Analyst Recommendation

The vulnerability in SiYuan presents a high risk due to the potential for full administrative account takeover by authenticated users. Organizations should prioritize updating to version 3.8.2 immediately to eliminate the exposure of API tokens. Failure to patch leaves the system susceptible to persistent administrative compromise, which could have severe downstream impacts on data security and system integrity.

Description Summary:
SiYuan versions before 3.8.1 are vulnerable to stored cross-site scripting due to improper sanitization of block name, alias, and memo fields in various rendering functions.

Executive Summary:
A stored cross-site scripting vulnerability in SiYuan allows authenticated attackers to execute arbitrary scripts in the browsers of other users who view compromised documents.

Vulnerability Details

CVE-ID: CVE-2026-82654

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.8.1

Vulnerability: The application fails to properly escape input in block names, aliases, and memo fields, which are processed during hint, backlink, and breadcrumb rendering. This flaw allows a low privileged, authenticated user to inject malicious HTML or script tags that trigger execution when other users view the affected content.

Business Impact

Successful exploitation allows an attacker to compromise user sessions, steal sensitive session tokens, or perform unauthorized actions on behalf of other users. With a CVSS score of 8.9, this vulnerability represents a high risk to data integrity and confidentiality, potentially leading to unauthorized access to private notes or account takeover within the application environment.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.8.1 or later, which includes the necessary security patches to sanitize user inputs.

Proactive Monitoring: Review application access logs for unusual patterns in block name updates or unexpected script-like characters being injected into metadata fields.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block common cross-site scripting payloads.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any authenticated user with sufficient permissions to modify document block properties, making prompt patching essential.

Analyst Recommendation

The severity of this vulnerability is significant due to the potential for lateral movement and account compromise through malicious script execution. Organizations using SiYuan must prioritize upgrading to version 3.8.1 to eliminate the risk of stored cross-site scripting. Delaying this update exposes all users to potential session hijacking and unauthorized data access.

Description Summary:
SiYuan versions before 3.8.1 are vulnerable to stored cross-site scripting in confirmDialog() due to improper neutralization of package and notebook names.

Executive Summary:
A stored cross-site scripting vulnerability in SiYuan prior to version 3.8.1 allows authenticated attackers to execute malicious scripts in the browsers of other users.

Vulnerability Details

CVE-ID: CVE-2026-82653

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.8.1

Vulnerability: This is a stored cross-site scripting (XSS) flaw occurring in the confirmDialog() function. The application fails to properly sanitize package and notebook names before rendering them via innerHTML, allowing an authenticated user to inject malicious scripts that execute when other users perform administrative actions like uninstalling packages.

Business Impact

The vulnerability carries a CVSS score of 8.9, reflecting its potential for significant impact on both confidentiality and integrity. Successful exploitation allows attackers to perform unauthorized actions on behalf of victims, potentially leading to the compromise of sensitive notebook data or administrative session hijacking.

Remediation Plan

Immediate Action: Upgrade SiYuan to version 3.8.1 or later to implement the necessary input sanitization.

Proactive Monitoring: Monitor application logs for suspicious activity involving the installation or removal of bazaar packages, particularly those containing unusual characters in their naming fields.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the sources from which scripts can be executed, reducing the impact of potential XSS attacks.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any authenticated user with the ability to submit bazaar packages, making the application of the vendor patch a high priority for environments with multiple users.

Analyst Recommendation

Given the severity of this stored XSS vulnerability, administrators should prioritize updating SiYuan to version 3.8.1 immediately. Failure to patch leaves the environment susceptible to script injection attacks that can bypass standard user permissions and compromise sensitive information stored within the application.

Description Summary:
The SiYuan Windows installer uses an uncontrolled search path, allowing local attackers to execute arbitrary code with elevated privileges by placing a malicious binary in the installer directory.

Executive Summary:
The SiYuan Windows installer for versions 2.0.14 through 3.8.0 is vulnerable to local privilege escalation due to an uncontrolled search path element during the installation process.

Vulnerability Details

CVE-ID: CVE-2026-82649

Affected Software: SiYuan SiYuan Note

Affected Versions: 2.0.14 up to (excluding) 3.8.1

Vulnerability: This vulnerability is caused by an uncontrolled search path element (CWE-427) in the NSIS installer, which resolves system executables via the installer directory rather than the secure System32 path. A local, low-privileged user can exploit this during an all-users installation to execute malicious code with elevated system privileges.

Business Impact

Successful exploitation of this flaw allows a low-privileged user to gain full administrative control over the affected Windows host. Given the CVSS score of 7.0, this high-severity vulnerability poses a significant risk to system integrity and confidentiality, as an attacker could install persistent backdoors, steal sensitive credentials, or exfiltrate data from the compromised machine.

Remediation Plan

Immediate Action: Upgrade SiYuan Note to version 3.8.1 or later to resolve the search path vulnerability.

Proactive Monitoring: Review Windows security event logs for unexpected execution of system binaries from non-standard directories, particularly during software installation events.

Compensating Controls: Ensure that users perform software installations from protected directories where they do not have write access, which prevents the planting of malicious binaries by unauthorized local users.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any local user capable of writing files to the directory where the installer is launched.

Analyst Recommendation

This vulnerability represents a critical security risk for environments where SiYuan Note is deployed via elevated installers. Administrators must prioritize updating to version 3.8.1 immediately to prevent local privilege escalation. Users should avoid running installers from directories where untrusted local users have write permissions until the patch is applied.

Description Summary:
SiYuan versions before 3.8.1 contain a server-side request forgery vulnerability allowing attackers to bypass SSRF defenses via DNS rebinding to access internal cloud metadata and services.

Executive Summary:
A high-severity server-side request forgery vulnerability in SiYuan before version 3.8.1 allows unauthenticated attackers to access sensitive internal network services and cloud metadata.

Vulnerability Details

CVE-ID: CVE-2026-82234

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.8.1

Vulnerability: This vulnerability is a time-of-check to time-of-use (TOCTOU) flaw in the http_request and web_fetch tools, which perform DNS resolution only during the initial guard check. An unauthenticated attacker can leverage DNS rebinding to substitute a public IP with a private or cloud metadata IP after the initial validation, successfully bypassing SSRF protections.

Business Impact

Successful exploitation allows unauthorized access to internal services or cloud instance metadata, potentially leading to the theft of credentials, environment configuration data, or internal system compromise. With a CVSS score of 8.2, this high-severity flaw poses a significant risk to the confidentiality of infrastructure residing within the same network as the SiYuan application.

Remediation Plan

Immediate Action: Update the SiYuan installation to version 3.8.1 or later to implement proper validation at the connect-time stage.

Proactive Monitoring: Inspect server logs for unusual outbound requests originating from the SiYuan application to internal IP ranges or cloud metadata endpoints (e.g., 169.254.169.254).

Compensating Controls: Deploy or configure a Web Application Firewall (WAF) to restrict outbound traffic from the application server to internal IP address ranges and sensitive metadata services.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any attacker capable of influencing DNS resolution, making it a critical concern for cloud-hosted deployments.

Analyst Recommendation

Given the potential for unauthorized data access and the high CVSS severity, administrators should prioritize updating to version 3.8.1 immediately. If an immediate update is not feasible, restrict the network reachability of the SiYuan host to prevent it from communicating with internal infrastructure or sensitive cloud metadata services.

Description Summary:
SiYuan is susceptible to a Cross-site Scripting vulnerability that can lead to remote code execution.

Executive Summary:
A critical cross-site scripting vulnerability in SiYuan software allows for remote code execution, posing a significant risk to local system integrity.

Vulnerability Details

CVE-ID: CVE-2026-75917

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: This vulnerability is a Cross-site Scripting (CWE-79) flaw occurring during web page generation. An attacker can exploit this via a specially crafted request, requiring user interaction to execute arbitrary code with the privileges of the application.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the host machine. Given the CVSS score of 8.6, this represents a high-severity risk that could lead to total system compromise, unauthorized data access, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update the SiYuan software to version 3.7.4 or later to apply the necessary security patches.

Proactive Monitoring: Review system and application logs for unusual request patterns, specifically those involving unexpected scripts or navigation to external resources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules to filter out malicious scripts before they reach the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 21, 2026, there is no confirmed active exploitation in the wild: however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it bridges the gap between client-side script injection and full remote code execution.

Analyst Recommendation

The high severity of this vulnerability, combined with the existence of a proof-of-concept, necessitates immediate action. Administrators must prioritize updating to version 3.7.4 to eliminate the risk of remote code execution.

Description Summary:
SiYuan note-taking software is vulnerable to cross-site scripting (XSS) that can be escalated to remote code execution (RCE) via unescaped block metadata in hint popups.

Executive Summary:
A high-severity cross-site scripting vulnerability in SiYuan can be leveraged to achieve remote code execution, posing a critical risk to user systems.

Vulnerability Details

CVE-ID: CVE-2026-75916

Affected Software: SiYuan SiYuan

Affected Versions: through 3

Vulnerability: This is a cross-site scripting (XSS) vulnerability resulting from the improper neutralization of input during web page generation. The vulnerability is particularly dangerous as it can be chained to achieve remote code execution through unescaped block metadata.

Business Impact

The ability to escalate XSS to remote code execution represents a total compromise of the user's environment. With a CVSS score of 8.6, this vulnerability could allow an attacker to gain full control over the local system where SiYuan is installed, potentially leading to data exfiltration or malware installation.

Remediation Plan

Immediate Action: Apply all available vendor security updates immediately to address the underlying metadata handling flaws.

Proactive Monitoring: Monitor for suspicious file system modifications or unusual network traffic originating from the SiYuan application process.

Compensating Controls: Use endpoint security solutions to restrict the ability of the SiYuan process to execute shell commands or spawn child processes.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the chain from XSS to RCE suggests that while the impact is high, the attack vector requires specific conditions to trigger.

Analyst Recommendation

Due to the potential for remote code execution, this vulnerability should be handled with the highest priority. Users are strongly encouraged to monitor the vendor security advisories and apply patches as soon as they become available for their specific deployment.

Description Summary:
SiYuan Note is vulnerable to brute-force attacks due to improper restriction of excessive authentication attempts in the publish service.

Executive Summary:
A vulnerability in the SiYuan Note publish service allows remote attackers to conduct brute-force authentication attacks, potentially leading to unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-74868

Affected Software: SiYuan Note

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to properly restrict excessive authentication attempts, which can be exploited by unauthenticated remote attackers to guess credentials via the publish service.

Business Impact

By failing to limit login attempts, the application is susceptible to brute-force attacks that can lead to account takeover. With a CVSS score of 7.5, this vulnerability poses a significant risk to the security of user accounts and the confidentiality of stored data, as attackers can gain access through credential stuffing or rapid password guessing.

Remediation Plan

Immediate Action: Upgrade SiYuan Note to version 3.7.4 or later to implement the necessary authentication rate limiting.

Proactive Monitoring: Monitor login logs for high volumes of failed authentication attempts originating from single or distributed IP addresses.

Compensating Controls: Implement account lockout policies or temporary IP blocking at the network edge if the patch cannot be applied immediately.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is a common implementation error that makes the authentication service vulnerable to brute-force techniques.

Analyst Recommendation

To mitigate the risk of unauthorized account access, administrators should update SiYuan Note to version 3.7.4 as soon as possible. This update introduces essential protections against brute-force attacks that are currently lacking in earlier versions.

Description Summary:
SiYuan is susceptible to a cross-site websocket hijacking vulnerability due to an origin validation error. This flaw allows unauthorized interaction with the application via malicious network proxies.

Executive Summary:
SiYuan versions prior to 3.7.4 contain an origin validation error that could allow attackers to perform cross-site websocket hijacking.

Vulnerability Details

CVE-ID: CVE-2026-74802

Affected Software: SiYuan SiYuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to properly validate the origin of websocket requests, an issue categorized as CWE-346. The vulnerability requires the attacker to be authenticated, though the interaction is triggered via a secondary user interface action.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized actions performed on behalf of an authenticated user. Given the CVSS score of 8.2, this represents a high severity risk that could compromise the integrity of user data and session control within the SiYuan environment, potentially leading to unauthorized data modification or administrative account manipulation.

Remediation Plan

Immediate Action: Update SiYuan to version 3.7.4 or later to implement the necessary origin validation checks.

Proactive Monitoring: Review application logs for unusual websocket connection patterns or requests originating from unexpected domains.

Compensating Controls: Deploy a Web Application Firewall to restrict websocket traffic and enforce strict origin header validation policies.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of August 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability relies on the complexity of origin validation in web-based applications.

Analyst Recommendation

The presence of a proof-of-concept, combined with the high CVSS score, necessitates immediate attention. Administrators must prioritize updating to version 3.7.4 to eliminate the underlying origin validation flaw and secure the application against potential hijacking attempts.

Description Summary:
SiYuan is vulnerable to OS command injection, which can lead to local privilege escalation when leveraging the elevator executable.

Executive Summary:
A critical OS command injection vulnerability in SiYuan allows an authenticated local attacker to escalate privileges and gain full control over the affected system.

Vulnerability Details

CVE-ID: CVE-2026-74801

Affected Software: SiYuan SiYuan

Affected Versions: < 3.7.4

Vulnerability: The application is susceptible to OS command injection (CWE-78). An attacker with low privileges can exploit this flaw to execute arbitrary system commands, potentially leading to total system compromise.

Business Impact

The ability to escalate privileges from a low-level user to full system control represents a critical security failure. With a CVSS score of 8.2, this vulnerability could be used by an attacker to exfiltrate sensitive data, install persistent backdoors, or disrupt core business operations.

Remediation Plan

Immediate Action: Update the SiYuan application to version 3.7.4 or later immediately.

Proactive Monitoring: Monitor for unexpected execution of system utilities or unusual child processes spawned by the SiYuan application.

Compensating Controls: Limit user permissions on the host operating system to prevent unauthorized access to sensitive application directories and executables.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous due to the potential for complete system compromise.

Analyst Recommendation

Given the existence of a proof of concept and the potential for total system compromise, this issue must be addressed with the highest priority. All instances of SiYuan should be updated to the latest version to neutralize the command injection vector.

Description Summary:
SiYuan versions before 3.7.4 are vulnerable to stored cross-site scripting due to missing security headers when serving user-uploaded assets, allowing script execution in the context of the owner.

Executive Summary:
A stored cross-site scripting vulnerability in SiYuan allows authenticated attackers to execute malicious scripts with full kernel access when a workspace owner interacts with a crafted asset link.

Vulnerability Details

CVE-ID: CVE-2026-74800

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to implement proper Content-Disposition and X-Content-Type-Options headers, enabling an authenticated attacker to upload malicious HTML files that execute upon access.

Business Impact

Successful exploitation poses a severe risk to organizational data integrity and confidentiality. Given the CVSS score of 9.0, this vulnerability permits full compromise of the application environment, potentially leading to unauthorized data exfiltration or administrative account takeover by an attacker who has gained initial access to the platform.

Remediation Plan

Immediate Action: Upgrade the SiYuan installation to version 3.7.4 or later to implement the required security header enforcement.

Proactive Monitoring: Audit application access logs for unusual file uploads or frequent requests to asset endpoints that deviate from typical user behavior.

Compensating Controls: Implement strict Content Security Policy (CSP) headers at the web server level to restrict the execution of untrusted scripts if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of August 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for full application-level script execution.

Analyst Recommendation

The critical nature of this vulnerability necessitates an immediate update to the patched version. Security administrators should prioritize this deployment to prevent potential lateral movement or data theft within the workspace environment.

Description Summary:
SiYuan versions before 3.7.4 expose unauthenticated Go debug endpoints, allowing remote attackers to extract sensitive in-memory data such as API keys and authentication codes.

Executive Summary:
A critical information disclosure vulnerability in SiYuan allows unauthenticated remote attackers to extract sensitive configuration data and API keys.

Vulnerability Details

CVE-ID: CVE-2026-74799

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: This vulnerability involves the improper exposure of Go net/http/pprof debug endpoints. Because these endpoints are enabled without authentication when the software is not running in production mode, an attacker can perform unauthenticated requests to retrieve memory dumps containing critical secrets.

Business Impact

The compromise of AccessAuthCode and AI provider API keys can lead to significant unauthorized access, data theft, and financial costs associated with hijacked cloud services. With a CVSS score of 9.3, this flaw is considered critical because it requires no authentication and provides direct access to sensitive internal application data.

Remediation Plan

Immediate Action: Upgrade the SiYuan installation to version 3.7.4 or later immediately. Ensure that the application is explicitly configured to run in production mode to disable debug endpoints.

Proactive Monitoring: Review application access logs for unusual requests to /debug/pprof/* paths. Monitor for unauthorized usage of any API keys that were potentially exposed.

Compensating Controls: Deploy a Web Application Firewall (WAF) to explicitly block access to any URI paths starting with /debug/pprof/ from external network ranges.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of Aug 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the ease of access to the debug interface.

Analyst Recommendation

Given the critical severity and the potential for total credential compromise, administrators must prioritize this update. Immediate patching is the only reliable method to ensure that sensitive memory contents are no longer exposed to unauthenticated network actors.

Description Summary:
The SiYuan kernel is vulnerable to path traversal, allowing an authenticated administrator to read or manipulate files outside of the intended directory.

Executive Summary:
The SiYuan kernel is affected by a path traversal vulnerability that enables an authenticated administrator to access or modify sensitive files on the host system.

Vulnerability Details

CVE-ID: CVE-2026-74798

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: This is a path traversal vulnerability (CWE-22) that allows an attacker with high privileges to bypass directory restrictions and interact with the filesystem.

Business Impact

Successful exploitation allows an authenticated administrator to read sensitive configuration files or potentially overwrite critical system files. This compromise of file integrity and confidentiality poses a high risk to the overall security posture of the host environment. The CVSS score of 8.7 reflects the high potential for impact despite the requirement for administrative privileges.

Remediation Plan

Immediate Action: Upgrade the SiYuan kernel to version 3.7.4 or later to fix the path traversal flaw.

Proactive Monitoring: Review file access logs and audit trails for unauthorized or unexpected file system operations performed by the application.

Compensating Controls: Ensure the application runs with the principle of least privilege, restricting the file system access permissions of the user account running the SiYuan kernel.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Path traversal vulnerabilities are common vectors for privilege escalation and data theft.

Analyst Recommendation

Administrators should treat this vulnerability with urgency and apply the update to version 3.7.4 immediately. Limiting administrative access to the application and ensuring the service runs with restricted system permissions will further mitigate the risk of exploitation.

Description Summary:
A missing authorization vulnerability exists in the development branch of SiYuan, allowing unauthenticated attackers to access restricted endpoints.

Executive Summary:
An unauthenticated authorization bypass in SiYuan before version 3.7.4 allows attackers to access sensitive data endpoints without valid credentials.

Vulnerability Details

CVE-ID: CVE-2026-73608

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: This vulnerability, classified as CWE-862, stems from a missing authorization check on a specific development endpoint. Because the endpoint requires no authentication, an unauthenticated attacker can query sensitive data by interacting directly with the application.

Business Impact

The ability for unauthenticated users to access sensitive endpoints can lead to significant information disclosure. With a CVSS score of 8.6, this vulnerability allows unauthorized actors to harvest data, potentially leading to a breach of internal notes or organizational knowledge bases, which may contain proprietary or sensitive information.

Remediation Plan

Immediate Action: Update the SiYuan application to version 3.7.4 or later to ensure proper authorization enforcement on all endpoints.

Proactive Monitoring: Review application access logs for suspicious requests to API endpoints, particularly those targeting attribute views or search targets from unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block unauthorized access to administrative or internal-facing API endpoints if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly automatable, increasing the risk of widespread scanning by malicious actors.

Analyst Recommendation

Given the ease of access provided by this vulnerability, it must be addressed urgently. Organizations should apply the update to version 3.7.4 immediately to prevent unauthorized data exposure through these exposed endpoints.

Description Summary:
The SiYuan kernel before 3.7.4 fails to restrict excessive authentication attempts, allowing unauthenticated attackers to brute-force API tokens and gain administrative access.

Executive Summary:
A critical authentication brute-force vulnerability in SiYuan kernel versions prior to 3.7.4 allows unauthenticated attackers to gain full administrative access.

Vulnerability Details

CVE-ID: CVE-2026-73056

Affected Software: siyuan-note siyuan

Affected Versions: < 3.7.4

Vulnerability: The CheckAuth middleware fails to enforce rate limiting or CAPTCHA requirements on API token authentication. This allows an unauthenticated remote attacker to perform unlimited brute-force guesses against the API token, leading to full RoleAdministrator access.

Business Impact

With a CVSS score of 9.8, this flaw presents a critical risk, as it allows attackers to gain full control over the application. Administrative access grants the ability to perform arbitrary file operations and execute SQL queries, leading to potential data exfiltration or complete loss of system integrity.

Remediation Plan

Immediate Action: Update siyuan-note siyuan to version 3.7.4 or later immediately to apply the necessary authentication rate limiting.

Proactive Monitoring: Review audit logs for high volumes of failed API authentication attempts or suspicious patterns originating from single IP addresses.

Compensating Controls: If an immediate update is not feasible, implement a Web Application Firewall (WAF) rule to rate-limit requests to API endpoints or block unauthorized IP addresses exhibiting rapid authentication failures.

Exploitation Status

Public Exploit Available: No (No confirmed weaponized exploit is documented in the provided data.)

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the lack of built-in lockout mechanisms.

Analyst Recommendation

This vulnerability is highly critical due to the ease of brute-forcing API tokens. All deployments of SiYuan must be updated to version 3.7.4 or later as the primary mitigation. Ensure that API tokens are sufficiently long and complex to further reduce the risk of successful guessing.

Description Summary:
SiYuan versions prior to 3.7.4 contain an authentication bypass vulnerability involving the websocket implementation, allowing unauthenticated remote access.

Executive Summary:
A high-severity authentication bypass vulnerability in SiYuan allows unauthenticated remote attackers to gain unauthorized access to the application via websocket communication.

Vulnerability Details

CVE-ID: CVE-2026-73054

Affected Software: SiYuan SiYuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application suffers from improper authentication (CWE-287), specifically within its websocket handling, which permits unauthenticated attackers to interact with the system without valid credentials.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a critical failure in the application security model. Exploitation provides attackers with unauthorized access to system functions, creating a high risk of data exfiltration and administrative compromise.

Remediation Plan

Immediate Action: Upgrade the SiYuan installation to version 3.7.4 or later to resolve the websocket authentication bypass.

Proactive Monitoring: Review websocket traffic and connection logs for unusual patterns or connections originating from unauthorized or external sources.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and filter incoming websocket traffic for suspicious handshake patterns or unauthorized access attempts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. This flaw represents a fundamental breakdown in the application authentication logic.

Analyst Recommendation

The severity of this authentication bypass requires immediate attention. Security teams must ensure all instances of SiYuan are patched to version 3.7.4 to prevent potential unauthorized access and maintain the integrity of the application.

Description Summary:
SiYuan versions before 3.7.4 are susceptible to cross-site scripting in the unicode2Emoji function, allowing arbitrary code execution in the renderer.

Executive Summary:
A critical cross-site scripting vulnerability in the SiYuan unicode2Emoji function permits attackers to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-73053

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: This is a CWE-79 vulnerability resulting from improper sanitization of codepoint branch output. By crafting specific document icons with hex-encoded markup, an authenticated attacker can execute arbitrary code within the renderer, which runs with Node integration enabled.

Business Impact

The vulnerability is rated as critical with a CVSS score of 9.0. It allows an attacker to bypass application-level controls to execute system-level commands, creating a direct path to full workstation or server compromise depending on where the application is deployed.

Remediation Plan

Immediate Action: Update to SiYuan version 3.7.4 or later, which includes necessary sanitization for the unicode2Emoji function.

Proactive Monitoring: Audit document icon metadata and look for abnormally long or hex-encoded strings that may indicate an attempt to trigger the vulnerable function.

Compensating Controls: Limit access to document creation or modification features for untrusted users until the software has been updated.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the application's configuration allowing Node.js integration in the renderer.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for full system compromise, immediate patching to version 3.7.4 is mandatory. Security teams should verify that all deployments are running the updated version to mitigate this risk.

Description Summary:
A stored cross-site scripting vulnerability in SiYuan allows authenticated attackers to execute arbitrary JavaScript by injecting malicious markup into attribute-view field names.

Executive Summary:
A stored cross-site scripting vulnerability in SiYuan can lead to arbitrary code execution when malicious attribute names are viewed by a user, particularly within the desktop client.

Vulnerability Details

CVE-ID: CVE-2026-73052

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to sanitize attribute-view field names, which are rendered via innerHTML in the sort menu. An authenticated attacker can rename a database field to include malicious scripts that execute in the context of the victim's session.

Business Impact

The impact is severe, as the vulnerability allows for arbitrary JavaScript execution. In the context of the SiYuan desktop client, where Node integration may be enabled, this vulnerability can escalate to full system command execution, threatening the integrity and confidentiality of the host environment.

Remediation Plan

Immediate Action: Update the SiYuan software to version 3.7.4 or later, which includes the necessary output encoding to prevent script injection.

Proactive Monitoring: Monitor for unusual modifications to database field names that contain HTML tags or script-related keywords.

Compensating Controls: Ensure that users are not granted unnecessary privileges to modify database structures and employ Content Security Policy (CSP) headers where applicable.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is elevated in desktop environments where improper neutralization of input can lead to local code execution.

Analyst Recommendation

While this vulnerability requires an authenticated user to initiate the injection, the potential for escalation to remote code execution in the desktop client is significant. Administrators should apply the update to version 3.7.4 as soon as possible to neutralize this stored XSS vector.

Description Summary:
SiYuan before v3.7.4 contains a stored Cross-site Scripting vulnerability in the attribute-view select option color field, allowing arbitrary JavaScript execution.

Executive Summary:
A critical stored cross-site scripting flaw in SiYuan allows authenticated users to execute arbitrary JavaScript by injecting malicious payloads into select option color fields.

Vulnerability Details

CVE-ID: CVE-2026-73050

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to validate or escape the color field within attribute-view select options. This allows an attacker to inject event-handler attributes by including quotation marks in the input, which then execute when other users view the affected database records.

Business Impact

This vulnerability allows for the execution of arbitrary JavaScript in the context of other users' sessions, which can lead to session hijacking, data theft, or unauthorized actions performed on behalf of the victim. With a CVSS score of 9.0, this poses a high risk to the security of user data and the overall integrity of the collaborative environment.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.7.4 or later immediately.

Proactive Monitoring: Review application logs for suspicious entries in attribute-view select options or unusual client-side script execution.

Compensating Controls: Limit the ability of users to define custom colors or metadata in attribute-view fields until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease of injecting malicious payloads into commonly used UI elements.

Analyst Recommendation

Given the critical severity of this cross-site scripting vulnerability, administrators should ensure all instances are updated to version 3.7.4 as soon as possible. Prompt patching is essential to prevent unauthorized code execution within the user base.

Description Summary:
The SiYuan CheckAuth middleware fails to enforce rate limiting or account lockout for HTTP Basic Authentication, allowing unauthenticated attackers to brute-force the workspace access code.

Executive Summary:
A critical authentication bypass vulnerability in SiYuan allows unauthenticated remote attackers to brute-force administrative access codes, potentially leading to a full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-73046

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to restrict excessive authentication attempts within the CheckAuth middleware for the HTTP Basic Authentication branch. This flaw allows unauthenticated attackers to perform unlimited brute-force attempts to guess the workspace access code and gain administrative privileges.

Business Impact

Successful exploitation grants an attacker full RoleAdministrator access to the application kernel. This level of access poses a severe risk of unauthorized data modification, total loss of confidentiality, and potential disruption of business operations, justifying the critical CVSS score of 9.8.

Remediation Plan

Immediate Action: Update the SiYuan software to version 3.7.4 or later to implement proper authentication rate limiting.

Proactive Monitoring: Review system access logs for high volumes of failed authentication attempts targeting the /api/* endpoints.

Compensating Controls: Implement network-level rate limiting or an IP-based blocklist via a Web Application Firewall to restrict automated brute-force traffic.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of constant-time string comparisons combined with the absence of account lockout mechanisms.

Analyst Recommendation

Given the ease of exploitation and the high level of access granted, this vulnerability presents an immediate risk to any exposed SiYuan instance. Organizations must prioritize updating to version 3.7.4 immediately to remediate the authentication bypass and prevent unauthorized administrative access.

Description Summary:
SiYuan versions prior to 3.7.4 are vulnerable to a lack of proper restrictions on authentication attempts, potentially allowing attackers to conduct brute force attacks against the application.

Executive Summary:
A high-severity authentication vulnerability in SiYuan allows unauthenticated attackers to perform brute force attacks, risking unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-73045

Affected Software: SiYuan SiYuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to properly restrict excessive authentication attempts (CWE-307), allowing unauthenticated remote attackers to bypass traditional rate limiting or lockout mechanisms.

Business Impact

This vulnerability carries a CVSS score of 7.5, reflecting a significant risk to confidentiality. Successful exploitation could lead to unauthorized access to sensitive user data or system configurations, potentially resulting in data breaches and loss of trust.

Remediation Plan

Immediate Action: Upgrade SiYuan to version 3.7.4 or later to implement proper authentication attempt restrictions.

Proactive Monitoring: Monitor authentication logs for patterns of high-frequency login attempts originating from single or distributed IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rate-limiting rules configured to block excessive requests to authentication endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable due to the lack of built-in threshold management for authentication requests.

Analyst Recommendation

Given the high CVSS score and the nature of the vulnerability, administrators must prioritize updating to version 3.7.4 immediately. Securing the authentication gateway is critical to preventing account takeovers and protecting sensitive information stored within the SiYuan environment.

Description Summary:
SiYuan versions before 3.7.4 are vulnerable to stored cross-site scripting via the setAttrViewColWidth API, which can lead to arbitrary code execution within the Electron renderer.

Executive Summary:
A critical stored cross-site scripting vulnerability in SiYuan allows authenticated attackers to execute arbitrary code with Node integration enabled.

Vulnerability Details

CVE-ID: CVE-2026-73044

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: This is a CWE-79 vulnerability where improper validation of table column width values permits malicious injection into style attributes. The vulnerability requires low privileges and user interaction, allowing an attacker to inject event handlers that trigger code execution in the Electron environment.

Business Impact

The exploitation of this vulnerability results in full system compromise, as the application runs with Node integration enabled. Given the CVSS score of 9.0, this represents a critical risk where an attacker can gain unauthorized control over the host system, leading to data exfiltration or total loss of system integrity.

Remediation Plan

Immediate Action: Update siyuan-note siyuan to version 3.7.4 or later to apply the necessary input validation and sanitization fixes.

Proactive Monitoring: Review application logs for unusual API calls to setAttrViewColWidth and monitor for unexpected process spawning from the SiYuan application.

Compensating Controls: Implement strict Content Security Policy (CSP) headers if possible to restrict the execution of unauthorized scripts within the application interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the combination of cross-site scripting and enabled Node.js integration within the renderer.

Analyst Recommendation

This vulnerability presents a severe risk to host system integrity. All administrators should prioritize updating to version 3.7.4 immediately to remediate this flaw and prevent potential remote code execution.

Description Summary:
SiYuan versions before 3.7.4 contain a remote code execution vulnerability in the Template calculation operator, allowing execution of arbitrary code via injected malicious templates.

Executive Summary:
A critical remote code execution vulnerability in the SiYuan desktop client allows an attacker to execute arbitrary code when a malicious database is opened.

Vulnerability Details

CVE-ID: CVE-2026-73043

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to 3.7.4

Vulnerability: This is a cross-site scripting (CWE-79) and remote code execution vulnerability originating from the Template calculation operator. The operator fails to sanitize user-authored Go templates, which are rendered with Node integration enabled in the desktop client.

Business Impact

Successful exploitation allows an attacker to achieve code execution on the host machine running the SiYuan desktop client. This could lead to local data theft, lateral movement within the network, or complete control over the user's workstation, justifying the critical severity rating.

Remediation Plan

Immediate Action: Upgrade the SiYuan desktop client to version 3.7.4 or later immediately.

Proactive Monitoring: Users should exercise caution when opening database files from untrusted sources and monitor for unexpected application behavior or unauthorized network connections.

Compensating Controls: Ensure the application is run with the least privilege necessary and utilize endpoint protection software to detect unauthorized child processes spawned by the SiYuan client.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of Aug 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the combination of template rendering and enabled Node integration.

Analyst Recommendation

All users of the SiYuan desktop client must update to version 3.7.4 to remediate this vulnerability. Given the ease with which local code execution can occur, users should avoid opening untrusted or shared SiYuan database files until the software has been patched.

Description Summary:
SiYuan before v3.7.4 is vulnerable to stored Cross-site Scripting via improperly escaped database menu metadata, allowing execution of arbitrary code due to Electron's insecure configuration.

Executive Summary:
A critical stored cross-site scripting vulnerability in SiYuan allows authenticated users to achieve remote code execution through manipulated menu metadata.

Vulnerability Details

CVE-ID: CVE-2026-73042

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to properly escape database menu metadata during HTML interpolation. This flaw allows an authenticated user to inject malicious markup that executes arbitrary JavaScript, which, due to the application's use of Electron with insecure configuration, can escalate to full remote code execution.

Business Impact

The ability to execute arbitrary code with the privileges of the application provides an attacker with complete control over the user's local system. Given the CVSS score of 9.0, this represents a critical risk to confidentiality, integrity, and availability, as it allows for data exfiltration and total compromise of the host environment.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.7.4 or later immediately.

Proactive Monitoring: Monitor for unusual script execution or unexpected outbound network connections from the SiYuan application process.

Compensating Controls: Restrict permissions on database fields and views to trusted users only until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe because it bridges the gap between stored XSS and remote code execution in an Electron environment.

Analyst Recommendation

This vulnerability represents a significant security risk due to the potential for remote code execution. Users are strongly advised to apply the version 3.7.4 update immediately to secure the application against potential exploitation.

Description Summary:
SiYuan versions before 3.7.4 allow arbitrary code execution via malicious PDF annotations that trigger script execution in the PDF renderer with Node.js access.

Executive Summary:
A critical vulnerability in SiYuan PDF annotation handling allows authenticated attackers to achieve arbitrary code execution on the host system.

Vulnerability Details

CVE-ID: CVE-2026-73041

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: This is a CWE-79 vulnerability where the setFileAnnotation endpoint fails to sanitize markup injected into annotation fields. When a user opens a compromised PDF, the injected payload executes with full Node.js privileges, bypassing standard browser security boundaries.

Business Impact

With a CVSS score of 9.0, this vulnerability poses a high risk of total system takeover. Successful exploitation allows an attacker to execute arbitrary commands, potentially leading to the theft of sensitive user data, credential harvesting, or further lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.7.4 or newer to ensure that annotation fields are properly escaped and sanitized before being written to disk.

Proactive Monitoring: Monitor user activity logs for suspicious PDF file access or unexpected modifications to annotation data.

Compensating Controls: Restrict the ability of users to import or annotate untrusted PDF files from external sources until the update is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe because it leverages the application's own file processing capabilities to trigger execution.

Analyst Recommendation

The risk of remote code execution via document processing is significant. Organizations must treat this as a high-priority update and deploy the patch to version 3.7.4 across all instances immediately.

Description Summary:
SiYuan versions up to v3.7.2 are vulnerable to SQL injection via the backlink/mention search query due to improper sanitization of single quotes in client-supplied search keywords.

Executive Summary:
A critical SQL injection vulnerability in SiYuan allows unauthenticated attackers to execute arbitrary SQL commands, resulting in unauthorized read and write access across the database.

Vulnerability Details

CVE-ID: CVE-2026-72811

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application fails to properly neutralize single quotes within the backlink/mention search functionality, allowing attackers to break out of SQL string literals. Because the database driver supports statement stacking, this permits attackers to execute arbitrary SQL commands with the privileges of the application.

Business Impact

This vulnerability allows an attacker to manipulate the underlying database, leading to potential data exposure, data modification, or deletion of sensitive information across all notebooks. Given the CVSS score of 10.0, the impact on confidentiality, integrity, and availability is considered total, which could result in significant operational disruption and loss of proprietary data.

Remediation Plan

Immediate Action: Update siyuan-note siyuan to version 3.7.4 or later immediately.

Proactive Monitoring: Review database access logs for unexpected SQL queries or signs of unauthorized data modification.

Compensating Controls: Implement strict input validation or use a WAF to filter out SQL injection patterns, such as single quotes and common SQL keywords, from search queries.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is high due to the ease of reachability on public-facing instances.

Analyst Recommendation

Organizations must prioritize updating to version 3.7.4 to remediate this critical flaw. Failure to patch leaves the system open to full database compromise, and immediate action is required to ensure the integrity of stored data.

Description Summary:
SiYuan note-taking software is susceptible to a missing authorization vulnerability, which can be exploited via websockets to bypass security boundaries.

Executive Summary:
SiYuan versions prior to 3.7.4 contain a missing authorization vulnerability that allows unauthenticated attackers to bypass security boundaries via websocket communication.

Vulnerability Details

CVE-ID: CVE-2026-72810

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The application suffers from a missing authorization flaw (CWE-862). This allows an unauthenticated attacker to interact with the application through websockets, effectively bypassing established security boundaries.

Business Impact

The lack of proper authorization mechanisms allows unauthenticated entities to interact with the application, potentially leading to unauthorized data access or system manipulation. Given the CVSS score of 8.6, this vulnerability poses a high risk to the confidentiality and integrity of the data stored within the SiYuan platform.

Remediation Plan

Immediate Action: Update the SiYuan application to version 3.7.4 or later to resolve the authorization failure.

Proactive Monitoring: Monitor websocket traffic for unusual connections or requests that do not originate from authorized client instances.

Compensating Controls: Restrict network access to the SiYuan instance to trusted IP addresses only, effectively limiting the potential attack surface while awaiting updates.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication for exploitation.

Analyst Recommendation

Due to the unauthenticated nature of this vulnerability, it presents a significant risk to any exposed SiYuan instances. Administrators should apply the provided patch immediately to ensure that authorization checks are correctly enforced across all communication channels.

Description Summary:
SiYuan note-taking software contains a path traversal vulnerability that allows authenticated users to access restricted directories via unvalidated input.

Executive Summary:
An authenticated path traversal vulnerability in SiYuan software allows unauthorized access to sensitive files, necessitating an immediate update to version 3.7.3.

Vulnerability Details

CVE-ID: CVE-2026-69086

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.3

Vulnerability: This is a path traversal vulnerability (CWE-22) triggered by improper validation of file path inputs. An authenticated user (PR:L) can manipulate request parameters to escape the intended directory and access unauthorized files on the underlying system.

Business Impact

A successful exploit allows an authenticated attacker to read sensitive files outside of the application's intended scope, potentially exposing configuration data or user credentials. With a CVSS score of 7.7, this vulnerability represents a high risk to data confidentiality and could facilitate further lateral movement or deeper system exploitation.

Remediation Plan

Immediate Action: Update the SiYuan software to version 3.7.3 or later immediately to resolve the path validation flaw.

Proactive Monitoring: Inspect web server logs for suspicious URL patterns containing directory traversal sequences, such as dot-dot-slash characters, targeting sensitive application paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block and alert on common path traversal attack strings directed at the application.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The fix is available via the vendor's repository, and the vulnerability is standard in its implementation of path traversal.

Analyst Recommendation

All users of SiYuan should upgrade to version 3.7.3 without delay. This update effectively closes the identified path traversal vector, significantly reducing the risk of unauthorized file access and potential information disclosure within the application environment.

Description Summary:
SiYuan contains a SQL injection vulnerability in the searchDocs endpoint, allowing unauthenticated attackers to read and modify database content via stacked queries.

Executive Summary:
A critical SQL injection vulnerability in SiYuan allows unauthenticated remote attackers to read and modify sensitive database content via the searchDocs API endpoint.

Vulnerability Details

CVE-ID: CVE-2026-69085

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to 3.7.3

Vulnerability: The /api/filetree/searchDocs endpoint fails to properly sanitize the keyword parameter, allowing for SQL injection. Because the application uses a SQLite driver that supports stacked queries, an attacker can execute arbitrary SQL commands to manipulate the database.

Business Impact

This vulnerability allows for the theft of all cleartext notebook data and unauthorized modification of database records. Given the potential for complete data loss and integrity compromise, this vulnerability is rated as a 10.0 critical risk.

Remediation Plan

Immediate Action: Update SiYuan to version 3.7.3 or later to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Review application access logs for unusual search query patterns or requests containing SQL syntax characters like semicolons.

Compensating Controls: Enable authentication for all publication modes and implement a Web Application Firewall (WAF) to filter malicious input from API requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication in certain configurations.

Analyst Recommendation

This is an extremely severe vulnerability that exposes the entirety of the database to unauthenticated attackers. Organizations running SiYuan must prioritize updating to version 3.7.3 immediately and ensure that publish mode settings are configured securely to minimize exposure.

Description Summary:
A critical SQL injection vulnerability in the SiYuan /api/search/searchEmbedBlock endpoint allows unauthenticated remote attackers to execute arbitrary SQL commands on the underlying database.

Executive Summary:
The SiYuan note-taking application is vulnerable to an unauthenticated remote SQL injection attack, which poses a critical risk of full data compromise and unauthorized database modification.

Vulnerability Details

CVE-ID: CVE-2026-69084

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.3

Vulnerability: This is an SQL injection vulnerability (CWE-89) where the application improperly sanitizes user-supplied input before passing it to the database driver. The vulnerability is reachable by unauthenticated users or those with limited RoleReader tokens, allowing for the execution of stacked SQL statements.

Business Impact

The ability to execute arbitrary SQL commands grants an attacker complete control over the application database. This facilitates the unauthorized reading of sensitive user notes, the modification of stored content, and potential persistent data corruption. Given the CVSS score of 10.0, this represents the highest level of severity and requires immediate attention to prevent total system compromise.

Remediation Plan

Immediate Action: Upgrade all instances of SiYuan to version 3.7.3 or later to apply the necessary input sanitization and security constraints.

Proactive Monitoring: Monitor application logs for unusual API request patterns or database queries containing SQL syntax characters, such as semicolons or comment operators.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing suspicious SQL injection patterns directed at the /api/search/searchEmbedBlock endpoint.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 3, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated interaction with a read-write database handle.

Analyst Recommendation

This vulnerability presents a severe risk to data integrity and confidentiality. Administrators should prioritize the update to version 3.7.3 immediately to eliminate this injection vector and secure the application against unauthorized access.

Description Summary:
A critical SQL injection vulnerability in the SiYuan fullTextSearchAssetContent endpoint allows unauthenticated attackers to read, modify, or delete data across multiple notebooks.

Executive Summary:
SiYuan contains a critical SQL injection vulnerability that permits unauthenticated remote attackers to manipulate the asset-content database, threatening the integrity and confidentiality of user data.

Vulnerability Details

CVE-ID: CVE-2026-69083

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.3

Vulnerability: This is an SQL injection vulnerability (CWE-89) triggered by improper handling of method parameters and REGEXP clauses within the fullTextSearchAssetContent endpoint. The vulnerability is exploitable by unauthenticated users or those with minimal RoleReader permissions, granting them unauthorized database access.

Business Impact

This vulnerability provides an attacker with the ability to perform unauthorized database operations, including data deletion and exfiltration. Given the potential to destroy or leak sensitive note content, the business impact is severe, particularly for organizations or individuals relying on SiYuan for sensitive information storage. A CVSS score of 10.0 reflects the critical urgency of this issue.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.7.3 or later immediately to patch the vulnerable endpoint and implement secure query handling.

Proactive Monitoring: Review database access logs for queries utilizing REGEXP clauses or unusual patterns associated with full-text search functions.

Compensating Controls: Utilize a WAF or reverse proxy to filter requests targeting the fullTextSearchAssetContent endpoint for malicious SQL syntax until the software is updated.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to its accessibility to anonymous, unauthenticated parties.

Analyst Recommendation

The severity of this SQL injection necessitates an immediate upgrade to version 3.7.3. Organizations must treat this as a high-priority patch to prevent unauthorized access and potential catastrophic data loss within their note-taking environments.

Description Summary:
SiYuan versions before 3.7.3 contain a missing authorization vulnerability that allows unauthenticated attackers to access sensitive information.

Executive Summary:
A missing authorization vulnerability in SiYuan versions prior to 3.7.3 allows unauthenticated remote attackers to access sensitive information, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-68587

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.3

Vulnerability: The software suffers from a missing authorization flaw (CWE-862) in its transaction handling, which permits unauthenticated users to perform unauthorized actions or retrieve restricted data.

Business Impact

Successful exploitation of this vulnerability allows unauthorized access to sensitive application data, which could lead to significant information disclosure. With a CVSS score of 8.6, this flaw is considered high severity, as it permits remote, unauthenticated access to potentially private notes and system configurations.

Remediation Plan

Immediate Action: Upgrade SiYuan to version 3.7.3 or later to apply the necessary authorization checks.

Proactive Monitoring: Inspect application and server access logs for anomalous GET requests or unusual transaction patterns originating from unauthorized IP addresses.

Compensating Controls: Implement network-level access controls or a Web Application Firewall to restrict access to the SiYuan interface to trusted internal networks only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly automatable, which increases the likelihood of opportunistic scanning.

Analyst Recommendation

Given the high CVSS score and the existence of a proof-of-concept, administrators should prioritize updating to version 3.7.3 immediately. Failure to patch leaves the system exposed to unauthorized data extraction by remote, unauthenticated actors.

Description Summary:
The SiYuan application contains a missing authorization vulnerability, allowing unauthenticated remote attackers to access sensitive information via specific API endpoints.

Executive Summary:
A missing authorization vulnerability in SiYuan prior to version 3.7.3 allows unauthenticated remote attackers to disclose sensitive content.

Vulnerability Details

CVE-ID: CVE-2026-68586

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.3

Vulnerability: This vulnerability, categorized as CWE-862, occurs when the application fails to perform necessary authorization checks before granting access to sensitive resources. An unauthenticated attacker can leverage this flaw to access data that should be restricted.

Business Impact

The lack of authorization controls creates a high risk of unauthorized information disclosure. Given the CVSS score of 8.6, this vulnerability could be leveraged to extract confidential notes and organizational data, leading to severe privacy and security incidents.

Remediation Plan

Immediate Action: Update the SiYuan application to version 3.7.3 or later immediately to enforce proper authorization checks.

Proactive Monitoring: Monitor API usage logs for unusual patterns or access to sensitive endpoints by unauthenticated sessions.

Compensating Controls: Use a network-level access control list or WAF to restrict access to the application endpoints until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While no public exploit is confirmed, the nature of the flaw makes it easily exploitable if the target is network-accessible.

Analyst Recommendation

Authorization flaws are critical security failures that can lead to significant data loss. It is imperative that administrators update their SiYuan installations to version 3.7.3 as soon as possible to ensure that internal resources are properly protected from unauthorized access.

Description Summary:
The SiYuan application contains an authentication bypass vulnerability via content endpoints, allowing unauthenticated remote attackers to access sensitive data.

Executive Summary:
An authentication bypass vulnerability in SiYuan prior to version 3.7.3 exposes sensitive data to unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2026-68584

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.3

Vulnerability: This vulnerability, classified as CWE-288, allows an unauthenticated attacker to bypass security checks through alternate paths or channels. This flaw specifically affects content endpoints, permitting unauthorized access to system data.

Business Impact

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive information stored within the SiYuan application. With a CVSS score of 8.6, the potential for data breach and loss of intellectual property is critical, especially since the attack vector does not require user authentication.

Remediation Plan

Immediate Action: Update SiYuan to version 3.7.3 or later to apply the necessary security patches and close the authentication bypass.

Proactive Monitoring: Regularly review access logs for suspicious requests to content endpoints originating from unknown or unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests targeting vulnerable content endpoints until the application can be updated.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is considered automatable, increasing the risk of widespread exploitation.

Analyst Recommendation

Given the critical nature of an authentication bypass and the existence of a proof-of-concept, users must upgrade to version 3.7.3 immediately. Failure to patch leaves sensitive data exposed to any remote attacker with network access to the instance.

Description Summary:
A stored cross-site scripting vulnerability in SiYuan allows high-privileged attackers to achieve remote code execution via malicious title, image, or IAL inputs.

Executive Summary:
A stored cross-site scripting vulnerability in SiYuan allows an authenticated attacker to achieve remote code execution, posing a critical threat to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-66396

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.2

Vulnerability: This vulnerability is a stored cross-site scripting flaw (CWE-79) that can be leveraged to execute arbitrary code. It requires an attacker to possess high-level privileges to inject malicious payloads into specific application fields.

Business Impact

Successful exploitation of this vulnerability leads to full system compromise, as the XSS primitive can be escalated to remote code execution. Given the CVSS score of 8.4, this represents a high risk of data theft, unauthorized persistent access, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update the SiYuan application to version 3.7.2 or later to apply the necessary security patches.

Proactive Monitoring: Monitor application logs for suspicious input patterns in title or metadata fields that may indicate injection attempts.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts within the application environment.

Exploitation Status

Public Exploit Available: No (no weaponized exploit confirmed).

Analyst Notes: As of July 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability's ability to transition from XSS to RCE makes it a high-priority target for threat actors.

Analyst Recommendation

The potential for remote code execution makes this a severe security concern. Administrators must prioritize updating to version 3.7.2 immediately to neutralize the risk of unauthorized command execution.

Description Summary:
A reflected cross-site scripting vulnerability in SiYuan desktop allows attackers to achieve remote code execution through malicious deep links that leverage insecure Electron renderer configurations.

Executive Summary:
SiYuan desktop versions prior to 3.7.2 are vulnerable to a reflected cross-site scripting attack that can be leveraged to achieve full remote code execution with Node.js privileges.

Vulnerability Details

CVE-ID: CVE-2026-66395

Affected Software: siyuan-note SiYuan

Affected Versions: 0 up to (excluding) 3.7.2

Vulnerability: The application improperly handles input within the bazaar plugin readme handler, allowing an attacker to inject malicious HTML payloads via a crafted siyuan:// deep link. Due to an insecurely configured Electron renderer, these scripts execute with full Node.js access, effectively bypassing traditional browser-based sandbox protections.

Business Impact

The ability to execute arbitrary code with Node.js privileges grants an attacker complete control over the host system. This level of compromise can lead to the theft of local files, installation of persistent malware, or lateral movement within the user's environment, warranting a critical severity rating.

Remediation Plan

Immediate Action: Update the SiYuan desktop application to version 3.7.2 or later to apply the necessary security fixes for the renderer configuration.

Proactive Monitoring: Monitor endpoint logs for suspicious child processes spawned by the SiYuan application or unexpected network connections originating from the desktop client.

Compensating Controls: Exercise caution when clicking on unrecognized deep links, especially those formatted as siyuan:// protocols, as these are the primary vector for this attack.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 27, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The complexity of the attack is low, increasing the likelihood of reliable exploitation by motivated adversaries.

Analyst Recommendation

The transition from cross-site scripting to full code execution is a high-impact event that necessitates an immediate software update. Users are strongly advised to upgrade to version 3.7.2 immediately to neutralize this threat.

Description Summary:
SiYuan is vulnerable to stored and reflected cross-site scripting (XSS) due to an improper neutralization of input during web page generation via a bypass in the SVG sanitizer.

Executive Summary:
An XSS vulnerability in SiYuan allows an authenticated attacker to execute arbitrary scripts in the context of other users, potentially leading to unauthorized data access or session compromise.

Vulnerability Details

CVE-ID: CVE-2026-66394

Affected Software: SiYuan-Note SiYuan

Affected Versions: All versions before 3.7.3

Vulnerability: This is a cross-site scripting (XSS) vulnerability (CWE-79) caused by a failure to properly sanitize SVG inputs. An authenticated attacker (PR:L) can inject malicious scripts that execute in the browser of a victim who views the affected content.

Business Impact

This vulnerability carries a CVSS score of 8.7, indicating a high risk of impact. If exploited, an attacker could steal session cookies, perform unauthorized actions on behalf of the user, or redirect users to malicious sites, which is particularly dangerous in collaborative note-taking environments.

Remediation Plan

Immediate Action: Update SiYuan to version 3.7.3 or later to apply the necessary sanitization patches.

Proactive Monitoring: Monitor application logs for suspicious input patterns or unexpected script execution reports from client browsers.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized external resources, which can mitigate the impact of XSS vulnerabilities.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly susceptible to exploitation if the application is used in a multi-user environment.

Analyst Recommendation

Given the availability of a proof-of-concept and the high severity of XSS in web-based applications, it is critical to apply the update to version 3.7.3 immediately. Failure to patch allows for a high risk of client-side compromise.

Description Summary:
SiYuan before 3.7.2 is vulnerable to missing authorization in the POST /mcp endpoint, allowing unauthenticated remote attackers to achieve full system compromise via arbitrary file operations.

Executive Summary:
A critical missing authorization vulnerability in SiYuan allows unauthenticated remote attackers to gain full administrative control over the affected installation.

Vulnerability Details

CVE-ID: CVE-2026-66012

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.2

Vulnerability: This vulnerability is a missing authorization flaw in the kernel API, where the POST /mcp endpoint lacks proper role enforcement. This allows an unauthenticated remote attacker to perform unauthorized file operations, extract sensitive configuration tokens, and execute arbitrary code on the host system.

Business Impact

The potential impact of this vulnerability is total system compromise, including the ability to read, modify, or delete sensitive data and execute malicious payloads. Given the CVSS score of 10.0, this represents a critical risk to confidentiality, integrity, and availability, potentially leading to a complete breach of the host environment.

Remediation Plan

Immediate Action: Update siyuan-note siyuan to version 3.7.2 or later immediately to apply the necessary authorization checks.

Proactive Monitoring: Review system access logs for anomalous requests to the /mcp endpoint and monitor file system activity for unexpected modifications in the data/plugins/ directory.

Compensating Controls: If immediate patching is not feasible, restrict network access to the SiYuan interface and disable the Publish server functionality to prevent anonymous access to the vulnerable API.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit exists in available data).

Analyst Notes: As of July 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the lack of authentication requirements and the broad capabilities exposed by the affected API.

Analyst Recommendation

This is a critical security flaw that requires immediate attention. Organizations must prioritize upgrading to version 3.7.2 to eliminate the risk of unauthenticated remote administrative takeover.

Description Summary:
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in its protocol handler, enabling remote code execution due to improper handling of user-supplied input in the tab header.

Executive Summary:
A critical cross-site scripting vulnerability in the SiYuan protocol handler permits unauthenticated attackers to execute arbitrary commands on the local operating system.

Vulnerability Details

CVE-ID: CVE-2026-65606

Affected Software: siyuan-note SiYuan

Affected Versions: 0 up to (excluding) 3.7.2

Vulnerability: The application incorrectly handles the icon parameter within the siyuan:// protocol handler, injecting unescaped input into the tab header. This cross-site scripting flaw exploits the enabled nodeIntegration setting to access Node.js primitives and execute system-level commands.

Business Impact

The vulnerability poses a severe threat, as it enables an attacker to gain full control over the user's desktop environment. A CVSS score of 9.6 reflects the ease of exploitation and the critical impact, which includes unauthorized access to local files and potential lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.7.2 or later to ensure the protocol handler correctly sanitizes input parameters.

Proactive Monitoring: Monitor for suspicious protocol handler triggers or attempts to pass malformed arguments to the SiYuan application.

Compensating Controls: Disable the ability for the browser or other applications to automatically launch the siyuan:// protocol if business requirements allow.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The combination of protocol handler exploitation and high-privilege renderer settings creates a direct path for system compromise.

Analyst Recommendation

This vulnerability demands immediate attention due to the high risk of command execution. Administrators should ensure all deployments are updated to version 3.7.2, as this is the only effective method to remediate the underlying flaw in the protocol handler.

Description Summary:
SiYuan before v3.7.2 is vulnerable to stored cross-site scripting in Attribute View, which can be leveraged to achieve arbitrary command execution due to excessive renderer privileges.

Executive Summary:
A critical stored cross-site scripting vulnerability in SiYuan allows unauthenticated attackers to achieve remote code execution on the host machine.

Vulnerability Details

CVE-ID: CVE-2026-65605

Affected Software: siyuan-note SiYuan

Affected Versions: 0 up to (excluding) 3.7.2

Vulnerability: The application fails to properly sanitize user input in the Attribute View database cell rendering, allowing the injection of malicious HTML. Because the desktop renderer runs with nodeIntegration enabled, this cross-site scripting flaw can be escalated to full arbitrary command execution.

Business Impact

A successful exploit allows an attacker to execute arbitrary commands on the underlying host system, leading to complete system compromise. With a CVSS score of 9.6, this vulnerability represents an extreme risk to data confidentiality, integrity, and availability, potentially allowing attackers to exfiltrate sensitive notes or deploy persistent malware.

Remediation Plan

Immediate Action: Update the SiYuan application to version 3.7.2 or higher immediately to apply the necessary input sanitization fixes.

Proactive Monitoring: Review application logs for unusual database queries or unexpected rendering of HTML tags in the Attribute View.

Compensating Controls: While a patch is available, users should restrict the application's network access to prevent potential callbacks to attacker-controlled infrastructure.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The ability to bridge a web-based injection to Node.js command execution makes this flaw highly dangerous.

Analyst Recommendation

Given the critical severity and the potential for remote code execution, organizations must prioritize upgrading to version 3.7.2. Any delay in patching leaves the host system vulnerable to total compromise via standard user interaction with the database interface.

Description Summary:
SiYuan is affected by a path traversal vulnerability that allows authenticated administrators to delete arbitrary files on the host system.

Executive Summary:
A path traversal vulnerability in SiYuan allows an authenticated administrator to trigger arbitrary file deletion, potentially leading to system instability or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-60084

Affected Software: siyuan-note siyuan

Affected Versions: 0 up to (excluding) 3.7.4

Vulnerability: The software contains a path traversal flaw (CWE-22) in the file management functionality. An attacker with high-level administrative privileges can manipulate path parameters to delete files outside of the intended directory.

Business Impact

While the attack requires administrative authentication, the ability to delete arbitrary files on the server poses a significant risk to system integrity and service availability. A CVSS score of 8.7 highlights that the impact on system files and configurations is severe, potentially resulting in permanent data loss or total application failure.

Remediation Plan

Immediate Action: Upgrade the SiYuan application to version 3.7.4 or later to address the insecure path handling logic.

Proactive Monitoring: Review administrative audit logs for suspicious file deletion activity or unusual access patterns involving system directories.

Compensating Controls: Implement file system permissions that restrict the application service account to only the directories absolutely necessary for its operation.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit exists in available data).

Analyst Notes: As of August 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for high privileges mitigates the risk from external internet-based attackers, but remains a critical risk for malicious or compromised internal administrative accounts.

Analyst Recommendation

Administrators should apply the provided patch immediately to prevent the potential for unauthorized file deletion. Restricting administrative access to trusted personnel remains a key defense-in-depth strategy for this application.

Description Summary:
SiYuan is vulnerable to stored Cross-Site Scripting (XSS) due to improper neutralization of script-related HTML tags, potentially allowing remote execution of malicious scripts.

Executive Summary:
An unauthenticated Cross-Site Scripting (XSS) vulnerability in SiYuan could allow attackers to execute arbitrary code in the context of a user's session.

Vulnerability Details

CVE-ID: CVE-2026-59855

Affected Software: SiYuan

Affected Versions: < 3.7.1

Vulnerability: This is a stored Cross-Site Scripting (XSS) vulnerability (CWE-80) resulting from the failure to properly sanitize HTML input. As the attack vector is network-based and requires no authentication, an attacker can inject malicious scripts into the application that execute when viewed by other users.

Business Impact

Successful exploitation of this vulnerability can lead to full account takeover, session hijacking, and the theft of sensitive personal knowledge data stored within the SiYuan instance. With a CVSS score of 8.6, this flaw presents a high risk of unauthorized access and potential data exfiltration, significantly impacting the confidentiality and integrity of the user's workspace.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.7.1 or later immediately to incorporate the necessary input sanitization patches.

Proactive Monitoring: Review web access logs for unusual patterns or payloads containing script tags associated with user input fields.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the sources from which scripts can be loaded, which may mitigate the impact of XSS attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS severity and the ease of exploitation, organizations and individuals using SiYuan must prioritize updating to version 3.7.1. Failure to patch may allow attackers to compromise the integrity of the knowledge management system and gain unauthorized access to stored data.

Description Summary:
The SiYuan personal knowledge management system contains multiple vulnerabilities, including Cross-site Scripting (XSS) and Code Injection, allowing for unauthorized remote execution.

Executive Summary:
SiYuan is affected by critical vulnerabilities, including XSS and code injection, that could allow an attacker to execute malicious code within the user's environment.

Vulnerability Details

CVE-ID: CVE-2026-59833

Affected Software: siyuan-note

Affected Versions: < 3.7.1

Vulnerability: The software fails to properly neutralize user input (CWE-79, CWE-116) and control code generation (CWE-94), facilitating XSS and arbitrary code injection. These flaws allow an unauthenticated attacker to inject malicious scripts that execute in the context of the victim's session.

Business Impact

These vulnerabilities present a high risk to users of the SiYuan platform, as successful exploitation could lead to session hijacking, credential theft, or the execution of arbitrary commands on the host machine. With a CVSS score of 8.6, the potential for widespread impact on knowledge management systems is significant, especially if used in collaborative environments.

Remediation Plan

Immediate Action: Upgrade SiYuan to version 3.7.1 or later to apply the necessary security patches and input validation controls.

Proactive Monitoring: Inspect web access logs for unusual script-based payloads and monitor for unauthorized modifications to local knowledge base files.

Compensating Controls: Use strict Content Security Policy (CSP) headers to mitigate the impact of potential XSS attacks if immediate updates are delayed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of code injection in a desktop/web-based application is inherently dangerous.

Analyst Recommendation

Users and administrators should prioritize updating to SiYuan version 3.7.1 immediately. These vulnerabilities allow for significant client-side and potentially server-side compromise, making timely remediation essential for maintaining the security of stored sensitive knowledge assets.

Description Summary:
SiYuan is vulnerable to path traversal, allowing authenticated users to access sensitive files outside of the intended directory structure.

Executive Summary:
A path traversal vulnerability in SiYuan allows an authenticated user to read sensitive files from the server, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-59832

Affected Software: SiYuan SiYuan

Affected Versions: < 3.7.1

Vulnerability: This vulnerability is a path traversal flaw (CWE-22/CWE-23) that allows an authenticated attacker to escape the application's root directory. The attack is performed over the network and requires the attacker to have an existing user account.

Business Impact

With a CVSS score of 7.7, this vulnerability represents a high risk to data confidentiality. An attacker could exploit this flaw to read arbitrary files on the server, potentially exposing configuration files, credentials, or sensitive user data, leading to a total breach of the application's security posture.

Remediation Plan

Immediate Action: Upgrade the SiYuan installation to version 3.7.1 or later to resolve the path traversal flaw.

Proactive Monitoring: Review application access logs for attempts to use directory traversal sequences (e.g., "../") in requests.

Compensating Controls: Implement strict file system permissions for the user running the SiYuan service to ensure the application cannot access files outside of its designated data directory.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing SiYuan must prioritize upgrading to version 3.7.1. Given the risk of unauthorized file access, failing to patch this vulnerability leaves the environment exposed to credential theft and sensitive data exfiltration by authenticated users.

Description Summary:
A high-severity vulnerability has been identified in the SiYuan personal knowledge management system that may compromise user data integrity.

Executive Summary:
The SiYuan personal knowledge management system is susceptible to a high-severity vulnerability that could result in unauthorized access to sensitive user data.

Vulnerability Details

CVE-ID: CVE-2026-54759

Affected Software: SiYuan SiYuan Note

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the SiYuan knowledge management platform. As the system handles sensitive personal and organizational data, flaws of this nature often involve unauthorized access or data manipulation, requiring immediate attention to prevent information disclosure.

Business Impact

With a CVSS score of 8.7, this vulnerability represents a high risk to the confidentiality and integrity of information stored within the SiYuan platform. Unauthorized access could lead to the exfiltration of proprietary knowledge, personal notes, and sensitive project documentation, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the SiYuan development team immediately upon release.

Proactive Monitoring: Audit user access logs within the application to identify any unusual administrative activities or unauthorized data access patterns.

Compensating Controls: If the instance is internet-facing, place the application behind a Web Application Firewall (WAF) to filter malicious requests until patching is completed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 25, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users and administrators of the SiYuan platform must treat this vulnerability with high priority. Implementing the vendor-supplied patch is the only effective way to mitigate this risk; until then, ensure that access to the application is strictly limited to authorized personnel.

Description Summary:
A critical XSS vulnerability in SiYuan's attribute-view cell renderer allows attackers to inject malicious scripts, leading to remote code execution on Electron desktop clients.

Executive Summary:
A high-severity XSS vulnerability in SiYuan’s database cell rendering allows for remote code execution on Electron-based desktop clients through weaponized attribute-view data.

Vulnerability Details

CVE-ID: CVE-2026-54158

Affected Software: SiYuan SiYuan

Affected Versions: Prior to 3.7.0

Vulnerability: The application fails to properly sanitize cell content in attribute-view rendering, allowing an attacker to inject malicious payloads into text, URL, phone, or mAsset fields. This leads to arbitrary JavaScript execution in the renderer process, which, due to nodeIntegration:true in Electron, results in host-level RCE.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a severe threat, enabling attackers to compromise the entire host operating system. Successful exploitation allows for persistent access to the victim's machine, potentially leading to the theft of sensitive proprietary knowledge and credentials stored within the application or on the local device.

Remediation Plan

Immediate Action: Patch SiYuan to version 3.7.0 or higher to implement mandatory input sanitization for database cell rendering.

Proactive Monitoring: Monitor workspace synchronization logs for unusual cell content or patterns that deviate from standard data entry.

Compensating Controls: Restrict collaborative editing access in shared workspaces to trusted individuals only until patches are fully deployed.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to trigger RCE via simple data entry makes this a critical security priority. System administrators must ensure that all instances are updated to the latest version to prevent malicious actors from leveraging synced workspaces as an attack vector.

Description Summary:
The SiYuan kernel HTTP server improperly trusts browser extension origins, allowing unauthenticated administrative API access and potential data exfiltration.

Executive Summary:
The SiYuan kernel HTTP server contains a critical authentication bypass flaw that allows malicious browser extensions to perform administrative actions without authorization.

Vulnerability Details

CVE-ID: CVE-2026-54069

Affected Software: SiYuan SiYuan Note

Affected Versions: Prior to 3.7.0

Vulnerability: The kernel HTTP server fails to perform proper origin validation, unconditionally trusting all browser extensions. Combined with a default empty authentication code, this allows unauthenticated attackers to execute administrative API calls.

Business Impact

This vulnerability carries a CVSS score of 9.2, representing an extremely high risk. Successful exploitation allows unauthorized parties to exfiltrate sensitive personal knowledge data, tamper with application configurations, and inject malicious scripts, effectively granting the attacker full administrative control over the application state.

Remediation Plan

Immediate Action: Update SiYuan to version 3.7.0 or later and ensure that a strong, non-default AccessAuthCode is configured immediately.

Proactive Monitoring: Review application logs for unexpected API calls originating from unauthorized or unrecognized browser-based sources.

Compensating Controls: Use network-level controls or host-based firewalls to restrict access to the SiYuan kernel port (6806) to trusted local processes only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The reliance on default configurations and permissive origin policies creates a significant security gap. Users must update to the latest version and enforce robust authentication protocols to prevent unauthorized administrative access to their knowledge base.

Description Summary:
A cross-site scripting (XSS) vulnerability in SiYuan's CSS snippet rendering allows attackers to execute arbitrary JavaScript, leading to remote code execution (RCE) on Electron desktop builds.

Executive Summary:
A critical XSS vulnerability in SiYuan's CSS snippet rendering allows for remote code execution on Electron-based desktop clients when malicious snippets are synced and rendered.

Vulnerability Details

CVE-ID: CVE-2026-54067

Affected Software: SiYuan SiYuan

Affected Versions: Prior to 3.7.0

Vulnerability: This vulnerability involves improper sanitization of CSS snippet bodies, where an attacker can inject malicious tags to break out of the rendering context. Because the Electron renderer operates with nodeIntegration:true, this XSS can be escalated to full RCE by an authenticated user with write access to a synced workspace.

Business Impact

The potential for remote code execution on the host machine presents an extreme risk to organizational data and system integrity. Given the 9.9 CVSS score, this vulnerability could allow an attacker to gain full control over the user's local environment, potentially exfiltrating sensitive knowledge management data or moving laterally within the network.

Remediation Plan

Immediate Action: Upgrade all SiYuan desktop instances to version 3.7.0 or later immediately to patch the rendering logic.

Proactive Monitoring: Review workspace repository logs for unauthorized modifications or suspicious CSS snippet injections.

Compensating Controls: Restrict write access to shared workspaces and enforce strict policies on the use of custom CSS or JS snippets within the knowledge base.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw cannot be overstated, as it transitions a simple XSS into a full system compromise. Organizations utilizing SiYuan must prioritize the update to version 3.7.0 across all client machines to mitigate the risk of RCE.

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the SiYuan Attribute View allows for remote code execution (RCE) within the Electron desktop client.

Executive Summary:
The SiYuan personal knowledge management system is vulnerable to a critical stored XSS flaw that enables remote code execution on the desktop client.

Vulnerability Details

CVE-ID: CVE-2026-50551

Affected Software: SiYuan SiYuan

Affected Versions: Prior to 3.7.0

Vulnerability: This vulnerability involves a stored XSS flaw within the database asset cell renderer. An attacker can leverage this to execute arbitrary code within the context of the Electron desktop client, bypassing standard application boundaries.

Business Impact

The ability to achieve remote code execution poses a severe threat to data integrity, confidentiality, and host security. With a CVSS score of 9.9, this vulnerability could allow an attacker to gain full control over the user's local machine, leading to total compromise of personal knowledge data and potentially lateral movement within the host environment.

Remediation Plan

Immediate Action: Upgrade the SiYuan desktop client to version 3.7.0 or later immediately to apply the necessary security patches.

Proactive Monitoring: Monitor local system activity for unusual process spawning originating from the SiYuan application.

Compensating Controls: Ensure the application is running in an environment with restricted permissions to limit the impact of a potential RCE event.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this RCE vulnerability, immediate action is required. Organizations and individuals using the SiYuan desktop client must prioritize updating to version 3.7.0 to eliminate the execution vector and protect sensitive local data.

Description Summary:
A stored Cross-Site Scripting (XSS) vulnerability in the SiYuan Marketplace allows attackers to execute arbitrary HTML/JS via malicious package metadata.

Executive Summary:
A critical XSS vulnerability in the SiYuan Marketplace allows attackers to execute arbitrary code in the context of a user's browser.

Vulnerability Details

CVE-ID: CVE-2026-45375

Affected Software: SiYuan

Affected Versions: Prior to 3.7.0

Vulnerability: The application fails to properly escape package metadata (name/version) fields, allowing malicious HTML/JS to be rendered and executed when a user views the Marketplace UI.

Business Impact

Successful exploitation allows an attacker to perform actions on behalf of the victim, potentially stealing session tokens or sensitive knowledge management data. With a CVSS score of 9.0, this is a significant threat to user-level security within the SiYuan environment.

Remediation Plan

Immediate Action: Upgrade SiYuan to version 3.7.0 or later to ensure proper sanitization of marketplace content.

Proactive Monitoring: Review application logs for unusual client-side errors or unexpected script execution patterns within the browser.

Compensating Controls: Use a modern browser with robust CSP (Content Security Policy) headers to restrict the execution of unauthorized scripts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should update their SiYuan installations immediately. Protecting users from malicious marketplace content is essential to maintaining the security of the personal knowledge management system.

Description Summary:
SiYuan is vulnerable to Cross-site Scripting (XSS) and Code Injection, allowing unauthenticated attackers to execute arbitrary code or scripts in the context of the application.

Executive Summary:
A critical vulnerability in SiYuan allows for remote code injection and cross-site scripting, posing a severe risk to user data and system integrity.

Vulnerability Details

CVE-ID: CVE-2026-44586

Affected Software: SiYuan Note SiYuan

Affected Versions: >= 2.1.12, < 3.7.0

Vulnerability: This flaw comprises both CWE-79 (Cross-site Scripting) and CWE-94 (Improper Control of Generation of Code). These vulnerabilities allow an unauthenticated attacker to inject malicious code or scripts that execute within the application's environment.

Business Impact

Successful exploitation of these vulnerabilities could lead to full system compromise, unauthorized data access, and the execution of malicious actions on behalf of authenticated users. Given the CVSS score of 8.3, this represents a high-severity risk that could result in significant reputational damage and loss of sensitive knowledge management data.

Remediation Plan

Immediate Action: Update the SiYuan installation to version 3.7.0 or later to apply the necessary security patches.

Proactive Monitoring: Monitor server logs for suspicious URL patterns or unexpected script execution attempts originating from web-based inputs.

Compensating Controls: Implement a strict Content Security Policy (CSP) and use a Web Application Firewall (WAF) to filter malicious payloads targeting common injection vectors.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The combination of XSS and code injection makes this a highly dangerous vector if left unpatched.

Analyst Recommendation

The severity of this vulnerability, combined with the presence of a known proof-of-concept, necessitates immediate action. Administrators must prioritize updating SiYuan to version 3.7.0 to eliminate the risk of remote code execution and cross-site scripting attacks.

Description Summary:
SiYuan, an open-source personal knowledge management system, is affected by a high-severity vulnerability that could lead to unauthorized access or system compromise.

Executive Summary:
A security vulnerability in the SiYuan knowledge management system poses a high risk to the confidentiality and integrity of stored personal data.

Vulnerability Details

CVE-ID: CVE-2026-41421

Affected Software: SiYuan

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects SiYuan, an open-source knowledge management platform. With a CVSS score of 8.8, the flaw likely involves improper authentication or input validation, potentially allowing an attacker to access user data or gain unauthorized control over the local instance.

Business Impact

The high CVSS score of 8.8 suggests a significant risk to users and organizations utilizing SiYuan. Successful exploitation could result in the unauthorized disclosure of sensitive knowledge bases, personal notes, or proprietary information stored within the system.

Remediation Plan

Immediate Action: Update SiYuan to the latest version released by the vendor to address the identified security flaw.

Proactive Monitoring: Audit access logs for the SiYuan application to identify any suspicious login attempts or unauthorized access to notes.

Compensating Controls: Ensure that the SiYuan instance is not exposed directly to the public internet and use VPN or proxy access to restrict exposure.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users and administrators of SiYuan should check the project's official security pages and apply updates immediately. Given the nature of knowledge management software, protecting the confidentiality of stored data should be the highest priority.

Description Summary:
SiYuan versions 3.6.3 and below are vulnerable to stored XSS in Mermaid diagrams, which can be escalated to arbitrary code execution on Electron-based desktop builds.

Executive Summary:
A critical vulnerability in SiYuan allows unauthenticated attackers to achieve arbitrary code execution via malicious Mermaid diagram injections.

Vulnerability Details

CVE-ID: CVE-2026-40322

Affected Software: SiYuan SiYuan

Affected Versions: 3.6.3 and below

Vulnerability: This vulnerability involves an improper rendering of Mermaid diagrams where "loose" security settings allow JavaScript injection. When processed within an Electron environment lacking context isolation, this stored XSS is escalated to arbitrary code execution.

Business Impact

The ability to execute arbitrary code on a user's machine poses a severe risk to confidentiality, integrity, and availability. With a CVSS score of 9.0, this flaw allows an attacker to compromise local data, install persistence, or pivot into the internal network.

Remediation Plan

Immediate Action: Upgrade the SiYuan application to version 3.6.4 or later immediately.

Proactive Monitoring: Review audit logs for suspicious activity involving note creation or unexpected external network connections originating from the application.

Compensating Controls: Restrict the use of untrusted Mermaid diagrams within the workspace until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for complete system compromise, organizations should prioritize the update to version 3.6.4 across all desktop instances. Failure to patch leaves the local environment exposed to malicious code execution.

Description Summary:
A path traversal vulnerability in the SiYuan API allows authenticated users to delete arbitrary JSON files on the host server via the id parameter.

Executive Summary:
A critical path traversal vulnerability in SiYuan versions 3.6.3 and prior allows authenticated attackers to delete sensitive configuration and metadata files, potentially leading to a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-40318

Affected Software: SiYuan SiYuan Note

Affected Versions: < 3.6.4

Vulnerability: The application fails to validate the id parameter in the /api/av/removeUnusedAttributeView endpoint, permitting path traversal sequences. This allows an authenticated attacker to escape the intended directory and delete arbitrary JSON files on the server.

Business Impact

The ability to delete arbitrary JSON files poses a significant risk to system integrity and availability. An attacker could remove global configuration files or essential workspace metadata, resulting in service disruption or loss of user data. Although the CVSS score of 8.5 reflects high severity, the requirement for authentication limits the attack surface to existing users.

Remediation Plan

Immediate Action: Upgrade SiYuan to version 3.6.4 or later immediately to incorporate the necessary path validation fixes.

Proactive Monitoring: Review access logs for requests to the /api/av/removeUnusedAttributeView endpoint containing suspicious path traversal patterns such as "../".

Compensating Controls: Implement strict file system permissions for the service account running the SiYuan process to limit the impact of unauthorized file deletion.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of input sanitization on a privileged file-management function.

Analyst Recommendation

The severity of this vulnerability necessitates prompt action despite the authentication requirement. Organizations utilizing SiYuan should prioritize the update to version 3.6.4 to prevent potential service disruption through malicious file deletion. All administrators should ensure that the application is running with the principle of least privilege to minimize the potential damage from similar future vulnerabilities.

Description Summary:
An improper authorization flaw in the /api/av/removeUnusedAttributeView endpoint of SiYuan allows authenticated attackers to delete arbitrary attribute view files, causing data and rendering loss.

Executive Summary:
An authorization vulnerability in SiYuan versions 3.6.3 and below allows authenticated users to perform unauthorized file deletions, resulting in significant workspace disruption.

Vulnerability Details

CVE-ID: CVE-2026-40259

Affected Software: SiYuan SiYuan

Affected Versions: < 0.0.0-20260407035653-2f416e5253f1, < 3.6.4

Vulnerability: The application fails to properly validate permissions on the /api/av/removeUnusedAttributeView endpoint, allowing users with low-privilege RoleReader tokens to execute file deletion commands. This improper authorization (CWE-285) permits an attacker to remove critical attribute view definitions without verifying ownership or usage status.

Business Impact

The ability for a low-privileged user to delete arbitrary attribute views can lead to the permanent loss of database structures and render the SiYuan workspace unusable. With a CVSS score of 8.1, the vulnerability presents a high risk to data integrity and system availability, potentially resulting in extensive downtime and manual recovery efforts for users relying on the platform for knowledge management.

Remediation Plan

Immediate Action: Upgrade the SiYuan kernel to version 0.0.0-20260407035653-2f416e5253f1 or the main application to version 3.6.4 or later immediately.

Proactive Monitoring: Review application access logs for unauthorized attempts to access the /api/av/ directory or abnormal frequencies of API calls related to attribute view management.

Compensating Controls: Implement strict access control lists or utilize a Web Application Firewall to block requests to the /api/av/removeUnusedAttributeView endpoint for non-administrative roles until the patch is applied.

Exploitation Status

Public Exploit Available: No (exploit_available unknown)

Analyst Notes: As of April 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any user possessing a valid publish-service RoleReader token.

Analyst Recommendation

Given the high impact on workspace integrity and the documented existence of proof-of-concept material, organizations should treat this vulnerability with high urgency. Administrators must prioritize the deployment of the 3.6.4 update to ensure that proper authorization checks are enforced on sensitive API endpoints, thereby preventing unauthorized data destruction.

Description Summary:
SiYuan personal knowledge management system is vulnerable to stored XSS, which can lead to remote code execution in the Electron desktop client.

Executive Summary:
A stored cross-site scripting vulnerability in SiYuan allows an attacker to achieve remote code execution on a victim's machine by syncing a malicious note.

Vulnerability Details

CVE-ID: CVE-2026-39846

Affected Software: SiYuan Desktop Client

Affected Versions: Prior to 3.6.4

Vulnerability: The vulnerability is caused by improper escaping of table caption content, which creates a stored XSS sink. Because the desktop client (based on Electron) operates with nodeIntegration enabled and contextIsolation disabled, the injected JavaScript gains full access to Node.js APIs, enabling remote code execution.

Business Impact

With a CVSS score of 9.0, this flaw poses a severe risk to users. Exploitation allows an attacker to execute arbitrary commands on the user's local workstation, potentially leading to the theft of local credentials, private notes, and complete compromise of the local environment.

Remediation Plan

Immediate Action: Update the SiYuan desktop client to version 3.6.4 or later immediately.

Proactive Monitoring: Users should monitor for suspicious note activity or unexpected synchronization behavior if they suspect their account has been compromised.

Compensating Controls: While difficult to mitigate via network controls, users should avoid syncing or opening notes from untrusted or unknown sources within the SiYuan platform.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

All users of the SiYuan desktop client must update to version 3.6.4 or later. Given the ability to achieve code execution through simple note synchronization, this update should be treated as a high-priority security maintenance task.

Description Summary:
A stored cross-site scripting vulnerability in SiYuan allows attackers to achieve remote code execution in the Electron desktop client by importing a malicious .sy.zip file.

Executive Summary:
A critical vulnerability in SiYuan Note allows for remote code execution via stored cross-site scripting when a user imports a specially crafted document.

Vulnerability Details

CVE-ID: CVE-2026-34585

Affected Software: SiYuan SiYuan Note

Affected Versions: < 3.6.2

Vulnerability: This flaw stems from improper neutralization of input during web page generation (CWE-79), where crafted block attributes bypass server-side escaping. Because the Electron desktop client environment grants access to Node APIs, the injected JavaScript results in remote code execution (CWE-94) when a victim opens a malicious note.

Business Impact

The potential for remote code execution poses a severe risk to organizational security, as an attacker can gain full control over the host system. Given the CVSS score of 8.6, this vulnerability is classified as High and requires immediate attention to prevent unauthorized access, data theft, or complete system compromise.

Remediation Plan

Immediate Action: Update all instances of the SiYuan desktop client to version 3.6.2 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Review file import logs and monitor for unusual activity originating from the SiYuan process, particularly any attempts to execute shell commands or spawn unexpected child processes.

Compensating Controls: Implement strict file validation policies that restrict the import of untrusted .sy.zip files from external sources until all endpoints are updated.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous because it facilitates a transition from cross-site scripting to full remote code execution in the context of the Electron framework.

Analyst Recommendation

Given the transition from a client-side scripting flaw to a full remote code execution primitive, this vulnerability represents a significant risk to any user relying on the SiYuan desktop application. Organizations should prioritize patching all installations to version 3.6.2 without delay to eliminate the underlying attack vector.

Description Summary:
An incorrect authorization vulnerability in SiYuan prior to version 3.6.2 allows unauthenticated attackers to bypass password protections and access bookmarked content from private documents.

Executive Summary:
A critical authorization flaw in SiYuan allows unauthenticated remote attackers to bypass password requirements and access sensitive, bookmarked document content.

Vulnerability Details

CVE-ID: CVE-2026-34453

Affected Software: SiYuan

Affected Versions: < 3.6.2

Vulnerability: The vulnerability exists in the publish service, specifically within the /api/bookmark/getBookmark endpoint, where improper handling of a null context causes the application to skip required authorization checks. This allows any unauthenticated visitor to retrieve bookmarked blocks from documents that are intended to be password protected.

Business Impact

Successful exploitation of this vulnerability leads to unauthorized disclosure of sensitive information stored within private knowledge base documents. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to data confidentiality, potentially resulting in the compromise of proprietary, personal, or sensitive organizational data.

Remediation Plan

Immediate Action: Upgrade the SiYuan kernel to version 3.6.2 or later to resolve the authorization logic error.

Proactive Monitoring: Review access logs for the /api/bookmark/getBookmark endpoint to identify unusual request patterns or high volumes of unexpected access from external IP addresses.

Compensating Controls: Implement network-level access controls or a Web Application Firewall (WAF) to restrict external access to the SiYuan publish service until the software can be patched.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. While no weaponized exploit is currently known, the presence of a Nuclei detection template suggests that automated scanning for this vulnerability is likely occurring.

Analyst Recommendation

This vulnerability represents a significant risk to the confidentiality of stored information due to the ease of exploitation by unauthenticated actors. Organizations utilizing SiYuan in a published or read-only mode should prioritize upgrading to version 3.6.2 immediately to close this authorization gap and prevent potential data exfiltration.

Description Summary:
SiYuan desktop application is vulnerable to Remote Code Execution via a permissive CORS policy. A malicious website can inject JavaScript into the Electron Node.js context without user interaction.

Executive Summary:
SiYuan's permissive CORS policy allows a malicious website to achieve Remote Code Execution on a user's desktop simply by having the victim visit a URL while the application is running.

Vulnerability Details

CVE-ID: CVE-2026-34449

Affected Software: SiYuan

Affected Versions: Prior to version 3.6.2

Vulnerability: The application implements a highly permissive CORS policy (Access-Control-Allow-Origin: *) that allows unauthenticated external websites to interact with its local API. An attacker can use this to inject a malicious JavaScript snippet that executes within the Electron Node.js context the next time the UI is opened.

Business Impact

This vulnerability poses a severe threat to individual workstation security and corporate data privacy. An attacker can gain full OS-level access to the victim's machine, allowing for the theft of sensitive notes, local files, and saved credentials. The CVSS score of 9.6 highlights the critical risk of zero-interaction RCE via a standard web browser.

Remediation Plan

Immediate Action: Update the SiYuan desktop application to version 3.6.2 or later to resolve the CORS policy and API injection flaws.

Proactive Monitoring: Monitor for unexpected outbound network connections from the SiYuan process and inspect local application logs for unauthorized API calls.

Compensating Controls: Utilize endpoint detection and response (EDR) tools to block suspicious child processes spawned by Electron-based applications.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation. However, the requirement for only a simple website visit makes this a highly attractive target for watering hole attacks.

Analyst Recommendation

Because this vulnerability requires no direct user interaction other than visiting a malicious site, it is a high-priority threat. Administrators should ensure all users update their desktop clients immediately. Failure to patch leaves the local system entirely vulnerable to remote takeover through common web browsing activity.

Description Summary:
SiYuan is vulnerable to a stored XSS-to-RCE chain in its Attribute View. Malicious URLs in the mAsse field trigger JavaScript execution with full OS access in the Electron client.

Executive Summary:
An attacker can achieve full Remote Code Execution on a victim's machine by placing a malicious URL in a shared SiYuan note, which executes with system privileges when viewed.

Vulnerability Details

CVE-ID: CVE-2026-34448

Affected Software: SiYuan

Affected Versions: Prior to version 3.6.2

Vulnerability: This is a stored Cross-Site Scripting (XSS) vulnerability within the Attribute View's mAsse field. Because the Electron client has nodeIntegration enabled and contextIsolation disabled, an authenticated attacker can inject JavaScript that bypasses the browser sandbox to execute arbitrary OS commands under the victim's account.

Business Impact

The impact is the complete compromise of the victim's workstation. Since the XSS is stored, any user who views the affected note or gallery view will be compromised. This could lead to lateral movement within a corporate network and the theft of sensitive intellectual property stored within the knowledge management system. The CVSS score of 9 reflects this high severity.

Remediation Plan

Immediate Action: Update SiYuan to version 3.6.2 or later, which properly escapes URLs and hardens the Electron environment.

Proactive Monitoring: Scan the application database for suspicious http or https strings in the mAsse fields that contain shell commands or obfuscated JavaScript.

Compensating Controls: Disable the "Gallery" and "Kanban" views if they are not required, as these are the primary vectors for triggering the malicious payload.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation. Stored XSS in collaborative tools is a common vector for internal corporate espionage.

Analyst Recommendation

The combination of stored XSS and a poorly secured Electron environment provides a direct path to RCE. Users should be advised not to open notes from untrusted sources until the application is updated to version 3.6.2. Immediate patching is required to mitigate the risk of account and system takeover.

Description Summary:
SiYuan versions prior to 3.6.2 allow unauthenticated directory traversal and filename retrieval via the /api/file/readDir interface, exposing the structure of user notebooks.

Executive Summary:
A critical information disclosure vulnerability in SiYuan allows unauthenticated attackers to map and retrieve the names of all documents within a notebook by abusing the file directory API.

Vulnerability Details

CVE-ID: CVE-2026-33670

Affected Software: SiYuan

Affected Versions: Versions prior to 3.6.2

Vulnerability: The /api/file/readDir interface lacks sufficient authorization checks, allowing an unauthenticated attacker to traverse the file structure and retrieve the names of all documents. This serves as a reconnaissance vector for further data theft.

Business Impact

While this specific CVE focuses on filename retrieval, it provides the necessary metadata for an attacker to target specific sensitive documents for exfiltration. The CVSS score of 9.8 reflects the high risk of data exposure and the lack of authentication required to perform the traversal.

Remediation Plan

Immediate Action: Upgrade the SiYuan installation to version 3.6.2 or higher immediately.

Proactive Monitoring: Review application logs for unauthorized calls to the /api/file/readDir endpoint.

Compensating Controls: Restrict access to the SiYuan API via firewall rules or host-level access control lists (ACLs) to ensure only trusted devices can interact with the service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability, combined with CVE-2026-33669, allows for the complete automated harvesting of a user's knowledge base. Immediate patching is the only effective way to secure the application against unauthenticated discovery.

Description Summary:
SiYuan versions prior to 3.6.2 are vulnerable to unauthorized data access where document IDs and content can be retrieved through the /api/file/readDir and /api/block/getChildBlocks interfaces.

Executive Summary:
SiYuan knowledge management systems are vulnerable to a critical information disclosure flaw that allows unauthenticated attackers to view the full content of all stored documents via API abuse.

Vulnerability Details

CVE-ID: CVE-2026-33669

Affected Software: SiYuan

Affected Versions: Versions prior to 3.6.2

Vulnerability: The vulnerability stems from insecure API endpoints that do not properly restrict access to document identifiers and content. An unauthenticated attacker can first list document IDs and then programmatically retrieve the full text of those documents using the /api/block/getChildBlocks interface.

Business Impact

For a personal knowledge management system, this vulnerability represents a total loss of confidentiality for all stored data. The CVSS score of 9.8 is justified by the fact that sensitive personal or corporate information can be harvested remotely without any authentication.

Remediation Plan

Immediate Action: Update SiYuan to version 3.6.2 or later to secure the affected API endpoints.

Proactive Monitoring: Monitor network traffic for excessive requests to the /api/block/ and /api/file/ endpoints, especially from unrecognized IP addresses.

Compensating Controls: If the application is hosted on a network, use an authentication proxy or VPN to restrict access to the SiYuan web interface to authorized users only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because SiYuan is often used to store highly sensitive personal or organizational data, this unauthenticated access flaw is critical. Users should update immediately and ensure their instances are not exposed to the public internet without additional layers of authentication.

Description Summary:
The SiYuan personal knowledge management system contains a security flaw that poses a risk to the confidentiality and integrity of stored information.

Executive Summary:
A vulnerability in the SiYuan system allows for potential unauthorized access to sensitive knowledge bases, necessitating an immediate security update.

Vulnerability Details

CVE-ID: CVE-2026-33476

Affected Software: SiYuan SiYuan Knowledge Management System

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the SiYuan application, a tool used for private data management. Given the high CVSS severity, the flaw likely permits an attacker to bypass security controls or execute unauthorized commands within the application environment.

Business Impact

A successful exploit could allow an attacker to read, modify, or delete sensitive notes and documents stored within the SiYuan system. For organizations using SiYuan for internal documentation, this could result in the leak of proprietary research or strategic plans. The 7.5 CVSS score indicates that the risk to data confidentiality and availability is substantial.

Remediation Plan

Immediate Action: Immediately update SiYuan to the latest version as specified in the vendor's security advisory.

Proactive Monitoring: Monitor system resource usage and file integrity within the SiYuan directory to detect potential unauthorized modifications.

Compensating Controls: Implement strict file system permissions and use a Web Application Firewall (WAF) to filter suspicious traffic targeting the knowledge management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of personal knowledge management tools makes them attractive targets for targeted information-gathering attacks.

Analyst Recommendation

Immediate patching is the primary and most effective defense against this vulnerability. Users should not delay in applying updates, as the high severity score suggests that the flaw could be easily leveraged if technical details become public. Ensure that all backups of the knowledge base are encrypted and stored securely during the update process.

Description Summary:
A security vulnerability has been identified in the SiYuan personal knowledge management system that could allow for unauthorized actions or data access.

Executive Summary:
A high-severity vulnerability in the SiYuan knowledge management system puts personal and organizational data at risk of unauthorized compromise.

Vulnerability Details

CVE-ID: CVE-2026-33203

Affected Software: SiYuan SiYuan Knowledge Management System

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: While the specific technical flaw is not detailed in the summary, the high CVSS score indicates a significant vulnerability within the SiYuan application logic. Based on the product type, this likely involves an authentication bypass or an insecure direct object reference (IDOR) affecting stored notes.

Business Impact

SiYuan is used for managing sensitive personal and professional knowledge; a compromise could lead to the total loss of intellectual property and private data. Unauthorized access to a knowledge management system can result in severe reputational damage and the exposure of confidential strategic information. The CVSS score of 7.5 highlights the urgent need for remediation to protect sensitive information assets.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates immediately to patch the underlying vulnerability in the SiYuan application.

Proactive Monitoring: Audit access logs for the SiYuan system to identify any unauthorized login attempts or unusual data export activities.

Compensating Controls: Ensure the SiYuan instance is not exposed directly to the public internet; use a VPN or zero-trust network access (ZTNA) to restrict access to authorized users only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation of this vulnerability. Users should remain vigilant as knowledge management systems are high-value targets for data theft.

Analyst Recommendation

Due to the sensitive nature of the data stored within SiYuan, this vulnerability should be treated with high priority. Organizations and individual users must apply the latest security patches immediately. Furthermore, reinforcing the hosting environment with strict network-level access controls is recommended to provide a layered defense against potential exploits.

Description Summary:
SiYuan versions 3.6.0 and below contain a click-through XSS vulnerability in the dynamic icon API due to incomplete SVG sanitization.

Executive Summary:
SiYuan knowledge management systems are vulnerable to a critical click-through XSS attack that can lead to unauthorized JavaScript execution via malicious SVG files.

Vulnerability Details

CVE-ID: CVE-2026-32940

Affected Software: SiYuan (Personal Knowledge Management System)

Affected Versions: 3.6.0 and below

Vulnerability: The /api/icon/getDynamicIcon endpoint serves user-controlled input directly into SVG markup without escaping. The sanitization process misses certain XML MIME types, allowing an unauthenticated attacker to craft a URL that, when clicked by a victim, executes JavaScript within the context of the application.

Business Impact

A successful Cross-Site Scripting (XSS) attack can allow an attacker to steal session cookies, perform actions on behalf of the user, or deface the application. Although it requires a "click-through," the high CVSS score of 9.3 highlights the significant risk to user data and the potential for session hijacking in a knowledge-heavy environment.

Remediation Plan

Immediate Action: Update SiYuan to version 3.6.1 or later to implement the corrected SVG sanitization logic and input escaping.

Proactive Monitoring: Inspect application logs for unusual parameters being passed to the dynamic icon API and monitor for reports of suspicious links within the SiYuan community.

Compensating Controls: Implement a strong Content Security Policy (CSP) that restricts the execution of inline scripts and prevents the loading of objects from untrusted origins.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. The vulnerability is technically detailed, suggesting that proof-of-concept exploits could be developed quickly.

Analyst Recommendation

The risk of XSS in a productivity tool like SiYuan is substantial. Users should update to version 3.6.1 immediately. Until the patch is applied, users should be warned against clicking on unknown links that point to their SiYuan instance's dynamic icon API.

Description Summary:
SiYuan versions 3.6.0 and below are vulnerable to path traversal and sensitive file exfiltration via improper validation of file:// links in pasted HTML.

Executive Summary:
SiYuan knowledge management systems are vulnerable to sensitive file exfiltration, allowing attackers to copy and read local files via crafted HTML content.

Vulnerability Details

CVE-ID: CVE-2026-32938

Affected Software: SiYuan (Personal Knowledge Management System)

Affected Versions: 3.6.0 and below

Vulnerability: The /api/lute/html2BlockDOM endpoint fails to validate file:// links in pasted HTML against a sensitive-path list. An attacker can trick the system into copying local files into the assets directory, which can then be accessed by an authenticated visitor via the GET /assets/*path endpoint.

Business Impact

The impact of this vulnerability is critical, as it allows for the unauthorized exfiltration of sensitive system files, including configuration files and personal data. With a CVSS score of 9.9, the risk to data confidentiality is extreme. Organizations or individuals using SiYuan for sensitive knowledge management could face significant data breaches and loss of privacy.

Remediation Plan

Immediate Action: Update SiYuan to version 3.6.1 or later immediately to resolve the path validation flaw.

Proactive Monitoring: Review the workspace assets directory for any unexpected files that may have been copied from sensitive local system paths.

Compensating Controls: Restrict access to the SiYuan web interface and disable the ability to paste HTML from untrusted sources until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. However, the technical details provided in the disclosure make it relatively straightforward for an attacker to craft an exploit.

Analyst Recommendation

The high CVSS score of 9.9 necessitates an immediate update to version 3.6.1. Users should be cautioned against pasting content from untrusted sources into the application until the update is confirmed. Prioritize the protection of the host machine's filesystem by applying the fix now.

Description Summary:
SiYuan versions 3.6.0 and below contain an authorization bypass in the search endpoint, allowing authenticated users to execute arbitrary SQL statements against the underlying SQLite database.

Executive Summary:
A critical authorization bypass vulnerability in SiYuan allows any authenticated user, including those with restricted permissions, to execute arbitrary SQL commands and potentially compromise the entire application database.

Vulnerability Details

CVE-ID: CVE-2026-32767

Affected Software: SiYuan Knowledge Management System

Affected Versions: 3.6.0 and below

Vulnerability: This flaw exists in the /api/search/fullTextSearchBlock endpoint when the method parameter is set to 2. An authenticated attacker with "Reader" role privileges can bypass security middleware to inject raw SQL statements directly into the SQLite database.

Business Impact

A successful exploit grants an attacker full control over the application's data layer. This results in total loss of data confidentiality, integrity, and availability, as an attacker can exfiltrate, modify, or delete all stored knowledge and system tables. The CVSS score of 9.8 reflects the critical nature of this flaw, where a low-privileged user can cause catastrophic system-wide impact.

Remediation Plan

Immediate Action: Administrators must upgrade SiYuan to version 3.6.1 or later immediately to apply the necessary authorization and read-only checks to the affected endpoint.

Proactive Monitoring: Review application logs for unusual activity involving the /api/search/fullTextSearchBlock endpoint, specifically looking for SQL syntax or the use of method=2 by non-admin users.

Compensating Controls: Restrict network access to the SiYuan instance to trusted IP addresses and consider implementing a Web Application Firewall (WAF) to filter for common SQL injection patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the ease of exploitation by any authenticated user and the critical impact on data integrity, the potential for internal or external exploitation is extremely high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it completely bypasses the application's security model. Organizations using SiYuan should prioritize the update to version 3.6.1. Failure to remediate this flaw leaves the entire knowledge base vulnerable to unauthorized manipulation or permanent deletion by any user with basic access.

Description Summary:
SiYuan versions 3.6.0 and below are susceptible to path traversal via the import API, allowing an authenticated administrator to write arbitrary files to the system and achieve remote code execution.

Executive Summary:
SiYuan versions 3.6.0 and below contain a path traversal vulnerability that permits an authenticated administrator to perform arbitrary file writes, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-32749

Affected Software: SiYuan

Affected Versions: 3.6.0 and below

Vulnerability: The application fails to sanitize the filename parameter during file imports via the POST /api/import/importSY and POST /api/import/importZipMd endpoints. This allows an authenticated administrator to bypass directory restrictions and overwrite critical system or application files.

Business Impact

The ability to overwrite arbitrary files on the host system poses a severe risk to data integrity and system availability. With a CVSS score of 7.6, the vulnerability is particularly dangerous in containerized environments where the application runs as root, as it allows an attacker to escalate privileges to full container compromise. Successful exploitation could result in total loss of confidentiality and integrity within the affected instance.

Remediation Plan

Immediate Action: Upgrade to SiYuan version 3.6.1 or later immediately to incorporate the necessary path sanitization logic.

Proactive Monitoring: Review application logs for unusual file import activity or attempts to access directories outside of the designated import paths.

Compensating Controls: Implement strict file system permissions for the service account running the SiYuan process to limit the impact of unauthorized file writes. A Web Application Firewall may be configured to inspect and block requests containing directory traversal sequences in the multipart filename field.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of input validation on the file import mechanism.

Analyst Recommendation

Given the potential for remote code execution and full container takeover, this vulnerability represents a high-risk security flaw. Administrators must prioritize the upgrade to version 3.6.1 to eliminate the underlying path traversal vector. Continued reliance on unpatched versions significantly increases the risk of unauthorized system modification and persistent compromise.

Description Summary:
The SiYuan knowledge management system contains a server-side request forgery (SSRF) vulnerability in the /api/network/forwardProxy endpoint, allowing authenticated users to perform arbitrary requests.

Executive Summary:
A critical SSRF vulnerability in SiYuan versions prior to 3.6.0 allows authenticated attackers to perform unauthorized requests against internal networks and cloud metadata services.

Vulnerability Details

CVE-ID: CVE-2026-32110

Affected Software: SiYuan SiYuan

Affected Versions: < 3.6.0

Vulnerability: The /api/network/forwardProxy endpoint fails to perform adequate URL validation, enabling an authenticated user to force the server to issue arbitrary HTTP requests. This flaw allows attackers to probe internal network infrastructure, interact with local services, or access sensitive cloud metadata endpoints.

Business Impact

This vulnerability poses a significant risk to internal network security. By leveraging the server as a proxy, an attacker can bypass perimeter firewalls to access internal-only services or steal credentials from cloud environment metadata, potentially leading to full system compromise or lateral movement. The CVSS score of 8.3 reflects the high potential for impact on confidentiality and integrity within the host environment.

Remediation Plan

Immediate Action: Update SiYuan to version 3.6.0 or later to apply the necessary URL validation logic.

Proactive Monitoring: Review web access logs for unusual patterns or requests originating from the /api/network/forwardProxy endpoint.

Compensating Controls: Implement strict egress filtering on the server to prevent it from initiating unauthorized connections to internal network segments or sensitive metadata IP addresses.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous because it provides a mechanism for an authenticated attacker to pivot into protected internal segments.

Analyst Recommendation

Given the potential for internal network reconnaissance and cloud resource exploitation, organizations should prioritize upgrading to version 3.6.0 immediately. If an immediate update is not feasible, restrict access to the affected API endpoint or implement strict network-level egress controls to limit the scope of potential SSRF abuse.

Description Summary:
A privilege escalation vulnerability in the SiYuan Note publish service allows authenticated users with read-only access to modify notebook content via the /api/block/appendHeadingChildren endpoint.

Executive Summary:
A privilege escalation vulnerability in SiYuan Note allows low-privilege users to modify notebook content, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-30926

Affected Software: SiYuan Note

Affected Versions: < 3.5.10

Vulnerability: This is an improper access control flaw (CWE-284/CWE-862) occurring in the /api/block/appendHeadingChildren endpoint. The application fails to enforce administrative authorization, allowing authenticated users with RoleReader privileges to perform unauthorized write operations.

Business Impact

The ability for unauthorized users to append or modify notebook content compromises the integrity of sensitive knowledge management data. Given the CVSS score of 7.1, this vulnerability is classified as High severity, as it enables authenticated attackers to bypass intended access restrictions and manipulate organizational or personal documentation.

Remediation Plan

Immediate Action: Update SiYuan Note to version 3.5.10 or later to ensure the proper authorization checks are enforced on the vulnerable API endpoint.

Proactive Monitoring: Review audit logs for unusual activity on the /api/block/appendHeadingChildren endpoint, specifically looking for write requests originating from accounts with RoleReader permissions.

Compensating Controls: If immediate patching is not feasible, restrict access to the publish service for untrusted accounts or implement network-level controls to limit exposure of the API endpoints.

Exploitation Status

Public Exploit Available: No (exploit_available unknown).

Analyst Notes: As of March 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is straightforward to trigger, as it relies on a missing capability check on a specific API function.

Analyst Recommendation

This vulnerability presents a clear risk to data integrity within the SiYuan Note environment. Administrators must prioritize updating to version 3.5.10 immediately to remediate the authorization flaw and prevent potential unauthorized modification of stored notebooks.

Description Summary:
A path traversal vulnerability in the SiYuan /export endpoint allows unauthenticated attackers to read arbitrary files from the server filesystem.

Executive Summary:
A critical path traversal vulnerability in SiYuan allows attackers to steal sensitive configuration files, potentially leading to full system compromise or remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-30869

Affected Software: SiYuan SiYuan

Affected Versions: Prior to 3.5.10

Vulnerability: A path traversal flaw exists in the /export endpoint, where double-encoded sequences can be used to bypass security filters. This allows an unauthenticated attacker to retrieve sensitive files, including API tokens and authentication secrets.

Business Impact

The exposure of API tokens and session secrets poses an extreme risk, as it grants attackers administrative access to the SiYuan kernel API. With a CVSS score of 9.3, this vulnerability could be chained to achieve remote code execution, resulting in total server compromise and potential exfiltration of all stored knowledge management data.

Remediation Plan

Immediate Action: Upgrade SiYuan to version 3.5.10 or later immediately to patch the affected /export endpoint.

Proactive Monitoring: Inspect server logs for suspicious URL patterns containing directory traversal sequences (e.g., ../, %2e%2e%2f).

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to block directory traversal attempts and double-encoded input strings.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Mar 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of the data exposure and the potential for remote code execution, immediate remediation is required. Ensure that all instances are updated to the latest version and verify that no unauthorized access to sensitive configuration files has occurred.

Description Summary:
SiYuan versions prior to 3.5.9 contain an unauthenticated reflected XSS vulnerability in the dynamic icon API endpoint, allowing JavaScript execution via crafted SVG outputs.

Executive Summary:
A critical unauthenticated reflected cross-site scripting (XSS) vulnerability in SiYuan allows remote attackers to execute arbitrary JavaScript and exfiltrate sensitive user data.

Vulnerability Details

CVE-ID: CVE-2026-29183

Affected Software: SiYuan Knowledge Management System

Affected Versions: Prior to version 3.5.9

Vulnerability: This flaw exists in the GET /api/icon/getDynamicIcon endpoint when the type parameter is set to 8. An unauthenticated attacker can provide malicious content that is embedded into an SVG output without proper escaping, leading to JavaScript execution in the context of the user's web session.

Business Impact

A successful exploit allows an attacker to perform actions on behalf of a logged-in user, potentially leading to the full compromise of the personal knowledge management system. With a CVSS score of 9.3, the risk is critical as it can result in the exfiltration of sensitive private notes, research, and authentication tokens, causing significant privacy breaches and data loss.

Remediation Plan

Immediate Action: Administrators and individual users must update SiYuan to version 3.5.9 or later immediately to patch the vulnerable API endpoint.

Proactive Monitoring: Security teams should review web server logs for suspicious requests to the /api/icon/getDynamicIcon endpoint, specifically looking for unusual characters or script tags in the query parameters.

Compensating Controls: Implementing a strict Content Security Policy (CSP) that restricts script execution and object-src can help mitigate the impact of XSS vulnerabilities if updates cannot be applied instantly.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the flaw is unauthenticated and can be triggered via a simple URL, the likelihood of exploitation is extremely high once the technical details are widely known.

Analyst Recommendation

The severity of this reflected XSS vulnerability cannot be overstated given its unauthenticated nature and the sensitive data typically stored within SiYuan. It is highly recommended that all users apply the version 3.5.9 update immediately to protect their data from unauthorized exfiltration and session hijacking.

Description Summary:
SiYuan's /api/file/copyFile endpoint fails to validate the 'dest' parameter, allowing authenticated users to write files to arbitrary locations, potentially leading to Remote Code Execution (RCE).

Executive Summary:
An arbitrary file write vulnerability in SiYuan allows authenticated users to achieve Remote Code Execution by overwriting critical system files such as cron jobs or SSH keys.

Vulnerability Details

CVE-ID: CVE-2026-25539

Affected Software: SiYuan Personal Knowledge Management System

Affected Versions: Prior to version 3.5.5

Vulnerability: The vulnerability is located in the /api/file/copyFile endpoint, where the dest parameter lacks proper validation. This allows an authenticated attacker to perform a path traversal attack to write files into sensitive directories, such as shell configuration files or authorized_keys.

Business Impact

While the attack requires authentication, the impact is critical (CVSS 9.1) as it facilitates full system compromise. An attacker could gain persistent access to the server, leading to the total loss of data integrity and confidentiality. This could result in the exposure of private knowledge bases and lateral movement within the corporate network.

Remediation Plan

Immediate Action: Update the SiYuan installation to version 3.5.5 or higher immediately to apply the necessary input validation patches.

Proactive Monitoring: Review system-level logs for unauthorized modifications to sensitive files like /etc/crontab, ~/.ssh/authorized_keys, and shell profiles.

Compensating Controls: Restrict access to the SiYuan API to trusted networks and implement the principle of least privilege for the user account running the SiYuan service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 4, 2026, there is no public information indicating active exploitation of this vulnerability. The requirement for authentication slightly reduces the risk compared to unauthenticated flaws, but the RCE potential remains a critical threat.

Analyst Recommendation

The ability to write to arbitrary filesystem locations is a high-risk condition. Organizations should enforce immediate updates to version 3.5.5 and audit the server for any signs of unauthorized persistence mechanisms.

Description Summary:
SiYuan personal knowledge management software contains a path traversal vulnerability in the importZipMd function, allowing authenticated users to overwrite system files and potentially execute code.

Executive Summary:
A path traversal vulnerability in SiYuan allows authenticated users to overwrite arbitrary system files, posing a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-67488

Affected Software: SiYuan SiYuan

Affected Versions: <= 0.0.0-20251202123337-6ef83b42c7ce

Vulnerability: The software fails to properly sanitize zip file paths within the importZipMd function, which constitutes a ZipSlip vulnerability. This allows an authenticated attacker to perform directory traversal and overwrite critical files on the underlying host system.

Business Impact

The ability to overwrite arbitrary files on the host system enables an attacker to gain unauthorized control over the application environment. Given the potential for privilege escalation and remote code execution, this vulnerability carries a CVSS score of 7.8, representing a high risk to data integrity and system availability.

Remediation Plan

Immediate Action: As a fix is only planned for version 3.5.0, administrators should restrict access to the import functionality to trusted users only or disable the feature if it is not business-critical.

Proactive Monitoring: Review system and application logs for unusual file write operations or unexpected path traversal patterns, particularly those originating from the import module.

Compensating Controls: Implement strict file system permissions for the user account running the SiYuan service to limit the impact of potential file overwrites, and utilize a Web Application Firewall to inspect incoming zip archives for malicious structures.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of December 10, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the nature of the ZipSlip flaw, which directly facilitates arbitrary file manipulation.

Analyst Recommendation

This vulnerability presents a severe risk to self-hosted environments. Organizations must prioritize monitoring the SiYuan GitHub repository for the release of version 3.5.0 and apply the update immediately upon availability to remediate the underlying flaw.